Adversarial machine learning at scale
Open accessAbstract
Adversarial examples are malicious inputs designed to fool machine learning models. They often transfer from one model to another, allowing attackers to mount black box attacks without knowledge of the target model's parameters. Adversarial training is the process of explicitly training a model on adversarial examples, in order to make it more robust to attack or to reduce its test error on clean inputs. So far, adversarial training has primarily been applied to small problems. In this research, we apply adversarial training to ImageNet. Our contributions include: (1) recommendations for how to succesfully scale adversarial training to large models and datasets, (2) the observation that adversarial training confers robustness to single-step attack methods, (3) the finding that multi-step attack methods are somewhat less transferable than single-step attack methods, so single-step attacks are the best for mounting black-box attacks, and (4) resolution of a "label leaking" effect that causes adversarially trained models to perform better on adversarial examples than on clean examples, because the adversarial example construction process uses the true label and the model can learn to exploit regularities in the construction process.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Fully decentralized variants of SGD and other optimization algorithms have recently been considered in machine learning both for improved scalability in datacenters and for decentralized networks of devices.
“fully decentralized variants of SGD and other optimization algorithms have recently been considered in machine learning both for improved scalability in datacenters [29] as well as for decentralized networks of devices [127, 459, 443, 59, 278, 291, 173].”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [443]
The Experiments section (p. 4) describes synchronous distributed training on 50 machines, not a fully decentralized optimization method. Searches for decentralized SGD, datacenter scalability, and networks of devices found no passage addressing the attributed claim. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 1
- Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, Ken Nakae, and Shin Ishii. Distributional smoothing with virtual adversarial training. In International Conference on Learning Representations (ICLR2016) , April 2016b.
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Boosting Adversarial Attacks with Momentum
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00957 · Cited by 3,168 · see citing works
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176 · see citing works
Self-citationThreat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
Akhtar, N., & Mian, A. (2018) · IEEE Access · doi:10.1109/access.2018.2807385 · Cited by 2,021 · see citing works
Chen, P., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140448 · Cited by 1,782 · see citing works
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Explainable AI (XAI): Core Ideas, Techniques, and Solutions
Dwivedi, R., Dave, D., Naik, H., Singhal, S., Omer, R., Patel, P., Qian, B., Wen, Z., Shah, T., Morgan, G., et al. (2023) · ACM Computing Surveys · doi:10.1145/3561048 · Cited by 1,386 · see citing works
Improving Transferability of Adversarial Examples With Input Diversity
Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., & Yuille, A. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00284 · Cited by 1,356 · see citing works
Kim, B., Wattenberg, M., Gilmer, J., Cai, C., Wexler, J., Viegas, F., & Sayres, R. (2017) · arXiv · doi:10.48550/arxiv.1711.11279 · Cited by 1,240 · see citing works
Robustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,240 · see citing works
Certified Adversarial Robustness via Randomized SmoothingPreprint
Cohen, J. M., Rosenfeld, E., & Kolter, J. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.02918 · Cited by 1,172 · see citing works
Countering Adversarial Images using Input TransformationsPreprint
Guo, C., Rana, M., Cissé, M., & van der Maaten, L. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.00117 · Cited by 1,151 · see citing works
Jin, D., Jin, Z., Zhou, J. T., & Szolovits, P. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i05.6311 · Cited by 1,108 · see citing works
A survey on adversarial attacks and defences
Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., & Mukhopadhyay, D. (2021) · CAAI Transactions on Intelligence Technology · doi:10.1049/cit2.12028 · Cited by 1,042 · see citing works
Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
Dong, Y., Pang, T., Su, H., & Zhu, J. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00444 · Cited by 1,034 · see citing works
Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser
Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., & Zhu, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00191 · Cited by 967 · see citing works
Adversarial Examples for Semantic Segmentation and Object Detection
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.153 · Cited by 955 · see citing works
Proceedings of the 29th ACM International Conference on Multimedia
Yue, J., Li, H., Wei, P., Li, G., & Lin, L. (2021) · doi:10.1145/3474085 · Cited by 927 · see citing works
Mitigating Adversarial Effects Through RandomizationPreprint
Xie, C., Wang, J., Zhang, Z., Ren, Z., & Yuille, A. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.01991 · Cited by 905 · see citing works
Generating Natural Language Adversarial Examples
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M. B., & Chang, K.-W. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1316 · Cited by 895 · see citing works
Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., & Song, D. (2021) · 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr46437.2021.01501 · Cited by 1,090 · see citing works
Raschka, S., Patterson, J. M., & Nolet, C. (2020) · Information · doi:10.3390/info11040193 · Cited by 777 · see citing works
Unleashing the potential of prompt engineering for large language models
CHEN, B. ‐., Zhang, Z., Langrené, N., & Zhu, S. (2025) · Patterns · doi:10.1016/j.patter.2025.101260 · Cited by 764 · see citing works
HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
Chen, J., Jordan, M. I., & Wainwright, M. J. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00045 · Cited by 718 · see citing works
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review
Xu, H., Ma, Y., Liu, H., Deb, D., Liu, H., Tang, J., & Jain, A. K. (2020) · Machine Intelligence Research · doi:10.1007/s11633-019-1211-x · Cited by 716 · see citing works
DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series
Munir, M., Siddiqui, S. A., Dengel, A. R., & Ahmed, S. (2018) · IEEE Access · doi:10.1109/access.2018.2886457 · Cited by 710 · see citing works
Adversarial Attacks on Neural Network PoliciesPreprint
Huang, S., Papernot, N., Goodfellow, I., Duan, Y., & Abbeel, P. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.02284 · Cited by 694 · see citing works
Self-citationAdversarial Attacks and Defenses in Deep Learning
Ren, K., Zheng, T., Qin, Z., & Liu, X. (2020) · Engineering · doi:10.1016/j.eng.2019.12.012 · Cited by 678 · see citing works
Challenges in deploying machine learning: A survey of case studies
Paleyes, A., Urma, R.-G., & Lawrence, N. D. (2023) · ACM Computing Surveys · doi:10.1145/3533378 · Cited by 638 · see citing works
Ross, A. S., & Doshi‐Velez, F. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11504 · Cited by 621 · see citing works
Adversarial Attacks on Deep-learning Models in Natural Language Processing
Zhang, W. E., Sheng, Q. Z., Alhazmi, A., & Li, C. (2020) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3374217 · Cited by 618 · see citing works
EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
Chen, P., Sharma, Y., Zhang, H., Yi, J., & Hsieh, C. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11302 · Cited by 594 · see citing works
Membership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 586 · see citing works
Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., & Goldstein, T. (2019) · ETH Zurich · doi:10.3929/ethz-b-000460345 · Cited by 580 · see citing works
Using Pre-Training Can Improve Model Robustness and UncertaintyPreprint
Hendrycks, D., Lee, K., & Mazeika, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09960 · Cited by 531 · see citing works
Certifying Some Distributional Robustness with Principled Adversarial TrainingPreprint
Sinha, A., Namkoong, H., Volpi, R., & Duchi, J. C. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.10571 · Cited by 515 · see citing works
Enhancing the Transferability of Adversarial Attacks through Variance Tuning
Wang, X., & He, K. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00196 · Cited by 514 · see citing works
Adversarial Examples Improve Image Recognition
Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A., & Le, Q. V. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00090 · Cited by 510 · see citing works
Opportunities and Challenges in Explainable Artificial Intelligence (XAI): A Survey
Das, A., & Rad, P. (2020) · arXiv · doi:10.48550/arxiv.2006.11371 · Cited by 504 · see citing works
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey
He, K., Kim, D. S., & Asghar, M. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3233793 · Cited by 494 · see citing works
Recent Advances in Adversarial Training for Adversarial Robustness
Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q. (2021) · arXiv · doi:10.48550/arxiv.2102.01356 · Cited by 490 · see citing works
“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”
BackgroundRecent Advances in Adversarial Training for Adversarial Robustness
Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q. (2021) · Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/591 · Cited by 490 · see citing works
On Adaptive Attacks to Adversarial Example Defenses
Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020) · arXiv · doi:10.48550/arxiv.2002.08347 · Cited by 486 · see citing works
Adversarial Robustness Toolbox v1.0.0
Nicolae, M.-I., Sinn, M., Tran, M. N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., Ludwig, H., et al. (2018) · arXiv · doi:10.48550/arxiv.1807.01069
Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep LearningPreprint
Papernot, N., & McDaniel, P. D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.04765 · Cited by 460 · see citing works
Towards Fast Computation of Certified Robustness for ReLU NetworksPreprint
Weng, T.-W., Zhang, H., Chen, H., Song, Z., Hsieh, C., Boning, D. S., Dhillon, I. S., & Daniel, L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.09699 · Cited by 460 · see citing works
When Machine Learning Meets Privacy: A Survey and Outlook
Liu, B., Ding, M., Shaham, S., Rahayu, W., Farokhi, F., & Lin, Z. (2022) · ACM Computing Surveys · doi:10.1145/3436755 · Cited by 455 · see citing works
Nesterov Accelerated Gradient and Scale Invariance for Adversarial AttacksPreprint
Lin, J., Song, C., He, K., Wang, L., & Hopcroft, J. E. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.06281 · Cited by 455 · see citing works
Survey on Collaborative Smart Drones and Internet of Things for Improving Smartness of Smart Cities
Alsamhi, S. H., Ma, O., Ansari, M. S., & Almalki, F. A. (2019) · IEEE Access · doi:10.1109/access.2019.2934998 · Cited by 441 · see citing works
Simple Black-box Adversarial Attacks
Guo, C., Gardner, J. R., You, Y., Wilson, A. G., & Weinberger, K. Q. (2019) · arXiv · doi:10.48550/arxiv.1905.07121 · Cited by 427 · see citing works
Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
Xu, K., Chen, H., Liu, S., Chen, P., Weng, T.-W., Hong, M., & Lin, X. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/550 · Cited by 418 · see citing works
Towards Robust Neural Networks via Random Self-ensemble
Liu, X., Cheng, M., Zhang, H., & Hsieh, C. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01234-2_23 · Cited by 408 · see citing works
AutoZOOM: Autoencoder-Based Zeroth Order Optimization Method for Attacking Black-Box Neural Networks
Tu, C., Ting, P., Chen, P., Liu, S., Zhang, H., Yi, J., Hsieh, C., & Cheng, S. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.3301742 · Cited by 387 · see citing works
Optimization problems for machine learning: A survey
Gambella, C., Ghaddar, B., & Naoum‐Sawaya, J. (2020) · European Journal of Operational Research · doi:10.1016/j.ejor.2020.08.045 · Cited by 383 · see citing works
Generative Adversarial Perturbations
Poursaeed, O., Katsman, I., Gao, B., & Belongie, S. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00465 · Cited by 370 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
FreeLB: Enhanced Adversarial Training for Natural Language UnderstandingPreprint
Zhu, C., Cheng, Y., Gan, Z., Sun, S., Goldstein, T., & Liu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.11764 · Cited by 352 · see citing works
Sensitivity and Generalization in Neural Networks: an Empirical StudyPreprint
Novak, R., Bahri, Y., Abolafia, D. A., Pennington, J., & Sohl‐Dickstein, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.08760 · Cited by 344 · see citing works
Su, D., Zhang, H., Chen, H., Yi, J., Chen, P., & Gao, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01258-8_39 · Cited by 342 · see citing works
ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples
Jia, X., Wei, X., Cao, X., & Foroosh, H. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00624 · Cited by 341 · see citing works
Scaling provable adversarial defensesPreprint
Wong, E., Schmidt, F. R., Metzen, J. H., & Kolter, J. Z. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12514 · Cited by 331 · see citing works
On the Robustness of Semantic Segmentation Models to Adversarial Attacks
Arnab, A., Mikšík, O., & Torr, P. H. S. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00099 · Cited by 323 · see citing works
Uncertainty-aware Joint Salient Object and Camouflaged Object Detection
Li, A., Zhang, J., Lv, Y., Liu, B., Zhang, T., & Dai, Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00994 · Cited by 322 · see citing works
Adversarial Attacks and Defences Competition
Kurakin, A., Goodfellow, I., Samy Bengio, A., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., Xie, C., et al. (2018) · The Springer series on challenges in machine learning · doi:10.1007/978-3-319-94042-7_11 · Cited by 321 · see citing works
Self-citationFormal Security Analysis of Neural Networks using Symbolic IntervalsPreprint
Wang, S., Pei, K.-X., Whitehouse, J., Yang, J., & Jana, S. (2018) · USENIX Security Symposium · doi:10.48550/arxiv.1804.10829 · Cited by 549 · see citing works
Advances in Adversarial Attacks and Defenses in Computer Vision: A Survey
Akhtar, N., Mian, A. S., Kardan, N., & Shah, M. (2021) · IEEE Access · doi:10.1109/access.2021.3127960 · Cited by 319 · see citing works
A Self-supervised Approach for Adversarial Robustness
Naseer, M., Khan, S. H., Hayat, M., Khan, F. S., & Porikli, F. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00034 · Cited by 317 · see citing works
Feature Importance-aware Transferable Adversarial Attacks
Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., & Ren, K. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00754 · Cited by 308 · see citing works
Self-supervised Learning of Adversarial Example: Towards Good Generalizations for Deepfake Detection
Chen, L., Zhang, Y., Song, Y., Liu, L., & Wang, J. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52688.2022.01815 · Cited by 307 · see citing works
Enhancing Stock Movement Prediction with Adversarial Training
Feng, F., Chen, H., He, X., Ding, J., Sun, M., & Chua, T. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/810 · Cited by 307 · see citing works
(2017) · doi:10.48550/arxiv.1712.02779 · Cited by 300 · see citing works
Prior Convictions: Black-Box Adversarial Attacks with Bandits and PriorsPreprint
Ilyas, A., Engstrom, L., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07978 · Cited by 300 · see citing works
Provably Robust Deep Learning via Adversarially Trained Smoothed ClassifiersPreprint
Salman, H., Yang, G., Li, J. Z., Zhang, P., Zhang, H., Razenshteyn, I., & Bubeck, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.04584 · Cited by 298 · see citing works
Improving Adversarial Robustness via Promoting Ensemble DiversityPreprint
Pang, T., Xu, K., Du, C., Chen, N., & Zhu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.08846 · Cited by 293 · see citing works
Adversarial Attacks in Modulation Recognition With Convolutional Neural Networks
Lin, Y., Zhao, H., Ma, X., Tu, Y., & Wang, M. (2020) · IEEE Transactions on Reliability · doi:10.1109/tr.2020.3032744 · Cited by 291 · see citing works
Anti-Adversarially Manipulated Attributions for Weakly and Semi-Supervised Semantic Segmentation
Lee, J., Kim, E., & Yoon, S. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00406 · Cited by 291 · see citing works
Universal Adversarial Perturbations Against Semantic Image Segmentation
Metzen, J. H., Kumar, M. C., Brox, T., & Fischer, V. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.300 · Cited by 287 · see citing works
Privacy and Security Issues in Deep Learning: A Survey
Liu, X., Xie, L., Wang, Y., Zou, J., Xiong, J., Ying, Z., & Vasilakos, A. V. (2020) · IEEE Access · doi:10.1109/access.2020.3045078 · Cited by 285 · see citing works
Delving Deep Into Label Smoothing
Zhang, C., Jiang, P.-T., Hou, Q., Wei, Y., Han, Q., Li, Z., & Cheng, M.-M. (2021) · IEEE Transactions on Image Processing · doi:10.1109/tip.2021.3089942 · Cited by 284 · see citing works
Analyzing Adversarial Attacks against Deep Learning for Intrusion Detection in IoT Networks
Ibitoye, O., Shafiq, O., & Matrawy, A. (2019) · 2019 IEEE Global Communications Conference (GLOBECOM) · doi:10.1109/globecom38437.2019.9014337 · Cited by 281 · see citing works
Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction
Liang, B., Li, H., Su, M., Li, X., Shi, W., & Wang, X. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2018.2874243 · Cited by 275 · see citing works
A taxonomy and survey of attacks against machine learning
Pitropakis, N., Panaousis, E., Giannetsos, T., Anastasiadis, E., & Loukas, G. (2019) · Computer Science Review · doi:10.1016/j.cosrev.2019.100199 · Cited by 268 · see citing works
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Zheng, T., Chen, C., Yuan, J., Li, B., & Ren, K. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00168 · Cited by 262 · see citing works
(2017) · arXiv (Cornell University) · Cited by 261 · see citing works
Adversarial and Clean Data Are Not Twins
Gong, Z., & Wang, W. (2023) · International Workshop on Exploiting Artificial Intelligence Techniques for Data Management (aiDM) · doi:10.1145/3593078.3593935 · Cited by 255 · see citing works
Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure
Feng, F., He, X., Tang, J., & Chua, T. (2019) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2019.2957786 · Cited by 243 · see citing works
Adversarial Examples: Opportunities and Challenges
Zhang, J., & Li, C. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2019.2933524 · Cited by 239 · see citing works
Miller, D. J., Xiang, Z. J., & Kesidis, G. (2020) · Proceedings of the IEEE · doi:10.1109/jproc.2020.2970615 · Cited by 238 · see citing works
Adversarial Transformation Networks: Learning to Generate Adversarial ExamplesPreprint
Baluja, S., & Fischer, I. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.09387 · Cited by 236 · see citing works
Backdoor Attacks Against Deep Learning Systems in the Physical World
Wenger, E., Passananti, J., Bhagoji, A. N., Yao, Y., Zheng, H.-T., & Zhao, B. Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00614 · Cited by 233 · see citing works
Re-imagining Algorithmic Fairness in India and Beyond
Sambasivan, N., Arnesen, E., Hutchinson, B., Doshi, T., & Prabhakaran, V. (2021) · Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency · doi:10.1145/3442188.3445896 · Cited by 228 · see citing works
“perturbation testing [156], data augmentation [220], adversarial testing [117], and adherence to terminology guidelines for oppressed groups, such as SIGACCESS.”
BackgroundA Survey on Adversarial Recommender Systems
Deldjoo, Y., Noia, T. D., & Merra, F. A. (2021) · ACM Computing Surveys · doi:10.1145/3439729 · Cited by 228 · see citing works
Constructing Unrestricted Adversarial Examples with Generative ModelsPreprint
Song, Y., Shu, R., Kushman, N., & Ermon, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.07894 · Cited by 227 · see citing works
Exploring Adversarial Examples in Malware Detection
Suciu, O., Coull, S. E., & Johns, J. M. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00015 · Cited by 225 · see citing works
Certified Adversarial Robustness with Additive NoisePreprint
Li, B., Chen, C., Wang, W., & Carin, L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.03113 · Cited by 225 · see citing works
HyperSIGMA: Hyperspectral Intelligence Comprehension Foundation Model
Wang, D., Hu, M., Jin, Y., Miao, Y., Yang, J., Xu, Y., Qin, X., Ma, J., Sun, L., Li, C., et al. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3557581 · Cited by 229 · see citing works
Generalizable Data-Free Objective for Crafting Universal Adversarial Perturbations
Mopuri, K. R., Ganeshan, A., & Babu, R. V. (2018) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2018.2861800 · Cited by 219 · see citing works
- Authors
- Kurakin, A., Goodfellow, I., & Bengio, S.
- Affiliations
- Google (United States) (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2016
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1611.01236
- OpenAlex
- W2552767274
- Cited by
- 2,325
- References
- 0
- Citations by year
- 2026: 2 · 2025: 93 · 2024: 264 · 2023: 259 · 2022: 281 · 2021: 475 · 2020: 447 · 2019: 329 · 2018: 143 · 2017: 30 · 2016: 2
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- adversarial training, adversarial examples, adversarial robustness, black-box attacks, transferability, multi-stage attacks, ImageNet, large-scale machine learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
