The DOI matches its DataCite record; 28 of the 30 references it cites were found in a registry or an index.
Towards Deep Learning Models Resistant to Adversarial Attacks
Open accessAbstract
Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. Code and pre-trained models are available at https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial training has proven to be an effective method for defending against adversarial attacks [56].”
From Enhancing the Robustness of AI-Generated Text Detectors: A Survey (2025) · cites this paper as [56]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Merino et al. [47] draw on Wang and Strong [74]'s canonical distinction between the intrinsic, contextual, accessibility, and representational aspects of datasets when using the above mentioned industry standards ISO/IEC 25012 and ISO/IEC 25024.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“contemporary authors continue to find value in existing data quality characterisations and conceptual structures.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measuredIn the citing paper
“Existing works in privacy-preserving federated learning are mostly developed based on the wellknown privacy-preserving techniques, including: (1) homomorphic encryption (HE), such as Paillier [90], Elgamal [91] and Brakerski-Gentry-Vaikuntanathan cryptosystems [92]; (2) Secure Multiparty Computation (SMC), such as garbled circuits [93] and secret sharing [94]; and (3) differential privacy (DP) [95”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [93]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · 2015 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2015.123 · Cited by 19,741
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
A unified architecture for natural language processing: deep neural networks with multitask learning
Collobert, R., & Weston, J. (2008) · Proceedings of the 25th international conference on Machine learning - ICML '08 · doi:10.1145/1390156.1390177 · Cited by 5,058
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,234
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Research works printed but not linked: 3
- [1][1] Aharon Ben-Tal, Laurent El Ghaoui, and Arkadi Nemirovski. Robust optimization . Princeton University Press, 2009. -
- [11][11] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR) , 2015. -
- [28][28] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014. -
Cited by
Sorted by citations
Items 901–1,000 of 1,030
Adversarial Attack Type I: Cheat Classifiers by Significant Changes
Tang, S., Huang, X., Chen, M., Sun, C., & Yang, J. (2019) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2019.2936378 · Cited by 37
Learning Reliable Visual Saliency For Model Explanations
Wang, Y., Su, H., Zhang, B., & Hu, X. (2019) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2019.2949872 · Cited by 36
Do Image Classifiers Generalize Across Time?
Shankar, V., Dave, A., Roelofs, R., Ramanan, D., Recht, B., & Schmidt, L. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00952 · Cited by 61
Self-citationHumpty Dumpty: Controlling Word Meanings via Corpus Poisoning
Schuster, R., Schuster, T., Meri, Y., & Shmatikov, V. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00115 · Cited by 34
Communication without Interception: Defense against Modulation Detection
Hameed, M. Z., György, A., & Gündüz, D. (2019) · IEEE Global Conference on Signal and Information Processing · doi:10.1109/globalsip45357.2019.8969541 · Cited by 37
Low Curvature Activations Reduce Overfitting in Adversarial Training
Singla, V., Singla, S., Feizi, S., & Jacobs, D. W. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01611 · Cited by 39
(2021) · doi:10.1145/3474369.3486863 · Cited by 37
Adversarial Attack for SAR Target Recognition Based on UNet-Generative Adversarial Network
Du, C., & Zhang, L. (2021) · Remote Sensing · doi:10.3390/rs13214358 · Cited by 37
Meta-learning-based adversarial training for deep 3D face recognition on point clouds
Yu, C., Zhang, Z., Li, H., Sun, J., & Xu, Z. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.109065 · Cited by 37
Pixle: a fast and effective black-box attack based on rearranging pixels
Pomponi, J., Scardapane, S., & Uncini, A. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892966 · Cited by 44
Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors
Shapira, A., Zolfi, A., Demetrio, L., Biggio, B., & Shabtai, A. (2023) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv56688.2023.00455 · Cited by 36
Characterizing and Understanding Software Security Vulnerabilities in Machine Learning Libraries
Harzevili, N. S., Shin, J., Wang, J., Wang, S., & Nagappan, N. (2023) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr59073.2023.00018 · Cited by 36
Wang, N., Luo, Y., Sato, T., Xu, K., & Chen, Q. A. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00407 · Cited by 36
Zhang, S., Lin, Y., Yu, J., Zhang, J., Xuan, Q., Xu, D., Wang, J., & Wang, M. (2024) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2024.3360514 · Cited by 36
Evidence-Based Multi-Feature Fusion for Adversarial Robustness
Wang, Z., Xu, X., Zhu, L., Bin, Y., Wang, G., Yang, Y., & Shen, H. T. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3582518 · Cited by 36
Efficient training of interval Neural Networks for imprecise training data
Sadeghi, J., de Angelis, M., & Patelli, E. (2019) · Neural Networks · doi:10.1016/j.neunet.2019.07.005 · Cited by 36
Towards Certificated Model Robustness Against Weight Perturbations
Weng, T.-W., Zhao, P., Liu, S., Chen, P., Lin, X., & Daniel, L. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i04.6105 · Cited by 36
Xi, B. (2020) · Wiley Interdisciplinary Reviews Computational Statistics · doi:10.1002/wics.1511 · Cited by 45
Adversarial Attacks are Reversible with Natural Supervision
Mao, C., Chiquier, M., Wang, H., Yang, J., & Vondrick, C. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00070 · Cited by 43
Xiao, Y., & Wang, C. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00197 · Cited by 37
Semi-supervised robust training with generalized perturbed neighborhood
Li, Y., Wu, B., Feng, Y., Fan, Y., Jiang, Y., Li, Z., & Xia, S. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.108472 · Cited by 46
Xu, M., Zhang, T., & Zhang, D. (2022) · IEEE Transactions on Medical Imaging · doi:10.1109/tmi.2022.3156268 · Cited by 40
Self-Adaptive Training: Bridging Supervised and Self-Supervised Learning
Huang, L., Zhang, C., & Change Institutions to: University of Waterloo (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3217792 · Cited by 43
SecureSense: Defending Adversarial Attack for Secure Device-Free Human Activity Recognition
Yang, J., Zou, H., & Xie, L. (2022) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2022.3226742 · Cited by 36
NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Models
Chen, S., Song, Z., Haque, M., Liu, C., & Yang, W. P. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01493 · Cited by 38
SlowLiDAR: Increasing the Latency of LiDAR-Based Detection Using Adversarial Examples
Liu, H., Wu, Y., Yu, Z., Vorobeychik, Y., & Zhang, N. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00498 · Cited by 36
Quality-Agnostic Deepfake Detection with Intra-model Collaborative Learning
Le, B. M., & Woo, S. S. (2023) · 2023 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.02045 · Cited by 36
Moreno, J. F. C., Rizzardi, A., Sicari, S., & Coen‐Porisini, A. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.110016 · Cited by 43
Similarity Min-Max: Zero-Shot Day-Night Domain Adaptation
Luo, R., Wang, W., Yang, W., & Liu, J. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00744 · Cited by 39
Robust Mixture-of-Expert Training for Convolutional Neural Networks
Zhang, Y., Cai, R., Chen, T., Zhang, G., Zhang, H., Chen, P., Chang, S., Wang, Z., & Liu, S. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00015 · Cited by 40
Guo, R., Chen, Q., Liu, H., & Wang, W. (2024) · Sensors · doi:10.3390/s24123909 · Cited by 35
Li, J., Li, J., Guo, Y., Yang, L., Chi, H., & Yang, L. (2025) · Drones · doi:10.3390/drones9040238 · Cited by 44
Hoang, M. L. (2025) · IEEE Access · doi:10.1109/access.2025.3573937 · Cited by 45
Adversarial Defense based on Structure-to-Signal Autoencoders
Folz, J., Palacio, S., Hees, J., & Dengel, A. R. (2020) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv45572.2020.9093310 · Cited by 34
SMGEA: A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories
Che, Z., Borji, A., Zhai, G., Ling, S., Li, J., Min, X., Guo, G., & Callet, P. L. (2020) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.3039295 · Cited by 36
Defense-PointNet: Protecting PointNet Against Adversarial Attacks
Zhang, Y., Liang, G., Salem, T., & Jacobs, N. (2019) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata47090.2019.9006307 · Cited by 35
Towards Achieving Adversarial Robustness by Enforcing Feature Consistency Across Bit Planes
Addepalli, S., Vivek, B. S., Baburaj, A., Sriramanan, G., & Babu, R. V. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00110 · Cited by 38
Xiao, Y., Pun, C., & Liu, B. (2020) · Information Sciences · doi:10.1016/j.ins.2020.04.022 · Cited by 35
Man-in-the-Middle Attacks Against Machine Learning Classifiers Via Malicious Generative Models
Wang, D., Li, C., Wen, S., Nepal, ., & Xiang, Y. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3021008 · Cited by 35
Robust Deep Learning Ensemble against Deception
Wei, W., & Liu, L. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3024660 · Cited by 35
Amora: Black-box Adversarial Morphing Attack
Wang, R., Juefei-Xu, F., Guo, Q., Huang, Y., Xie, X., Ma, L., & Liu, Y. (2020) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3394171.3413544 · Cited by 34
Unsupervised Adversarially Robust Representation Learning on Graphs
Xu, J., Yang, Y., Chen, J., Jiang, X., Wang, C., Lu, J., & Sun, Y. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i4.20349 · Cited by 35
Appending Adversarial Frames for Universal Video Attack
Chen, Z., Xie, L., Pang, S., He, Y., & Tian, Q. C. (2021) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv48630.2021.00324 · Cited by 42
Cognitive data augmentation for adversarial defense via pixel masking
Agarwal, A., Mayank Vatsa, A., Singh, R., & Ratha, N. (2021) · Pattern Recognition Letters · doi:10.1016/j.patrec.2021.01.032 · Cited by 35
Fooling deep neural detection networks with adaptive object-oriented adversarial perturbation
Xiao, Y., Pun, C., & Liu, B. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.107903 · Cited by 35
DVS-Attacks: Adversarial Attacks on Dynamic Vision Sensors for Spiking Neural Networks
Marchisio, A., Pira, G., Martina, M., Masera, G., & Shafique, M. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534364 · Cited by 36
DeHiB: Deep Hidden Backdoor Attack on Semi-supervised Learning via Adversarial Perturbation
Yan, Z., Li, G., Tian, Y., Wu, J., Li, S., Chen, M., & Poor, H. V. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i12.17266 · Cited by 36
Adversarial Robustness for Unsupervised Domain Adaptation
Awais, M., Zhou, F., Xu, H., Hong, L., Luo, P., Bae, S., & Li, Z. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00845 · Cited by 36
A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking
Li, Z., Shi, Y., Gao, J. G., Wang, S., Li, B., Liang, P., & Hu, W. (2021) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2021.3120479 · Cited by 35
Lynn, T., Mooney, J. G., Lee, B., & Endo, P. T. (2020) · Palgrave studies in digital business & enabling technologies · doi:10.1007/978-3-030-41110-7 · Cited by 49
Cycle-Consistent Counterfactuals by Latent Transformations
Khorram, S., & Li, F. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.00996 · Cited by 39
Transformer Based Defense GAN Against Palm-Vein Adversarial Attacks
Li, Y., Ruan, S., Qin, H., Deng, S., & El‐Yacoubi, M. A. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3243782 · Cited by 39
Liu, H., Chen, P., Ouyang, X., Gao, H., Yan, B. C., Grosso, P., & Zhao, Z. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2023.03.029 · Cited by 39
A Light Recipe to Train Robust Vision Transformers
Debenedetti, E., Sehwag, V., & Mittal, P. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00024 · Cited by 51
Rakin, A. S., Yi, J., Gong, B., & Fan, D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.06714 · Cited by 55
Willeke, K. F., Restivo, K., Franke, K., Nix, A., Cadena, S. A., Shinn, T., Nealley, C., Rodriguez, G., Patel, S. S., Ecker, A. S., et al. (2023) · bioRxiv (Cold Spring Harbor Laboratory) · doi:10.1101/2023.05.12.540591 · Cited by 44
Language Model Agnostic Gray-Box Adversarial Attack on Image Captioning
Aafaq, N., Akhtar, N., Liu, W., Shah, M., & Mian, A. S. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3226905 · Cited by 35
MalPatch: Evading DNN-Based Malware Detection With Adversarial Patches
Zhan, D., Duan, Y., Hu, Y., Li, W., Guo, S., & Pan, Z. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3333567 · Cited by 34
Adversarial sample attacks and defenses based on LSTM-ED in industrial control systems
Liu, Y., Xu, L., Yang, S., Zhao, D., & Li, X. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103750 · Cited by 36
Rahman, M. A., Islam, M. R., Hossain, M. J., Raña, M. S., Hossain, M. J., & Gray, E. M. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2024.108785 · Cited by 34
Adversarial Attacks in Explainable Machine Learning: A Survey of Threats Against Models and Humans
Vadillo, J., Santana, R., & Lozano, J. A. (2024) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.1567 · Cited by 42
Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey
Truong, V. T., Dang, L., & Le, L. B. (2025) · ACM Computing Surveys · doi:10.1145/3721479 · Cited by 59
Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
Kumari, N., Singh, M., Sinha, A., Machiraju, H., Krishnamurthy, B., & Balasubramanian, V. N. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/385 · Cited by 34
Ren, Z. X., Baird, A., Han, J., Zhang, Z., & Schuller, B. W. (2020) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp40776.2020.9054087 · Cited by 34
Exploiting Joint Robustness to Adversarial Perturbations
Dabouei, A., Soleymani, S., Taherkhani, F., Dawson, J. M., & Nasrabadi, N. M. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00120 · Cited by 34
Defense for Black-Box Attacks on Anti-Spoofing Models by Self-Supervised Learning
Wu, H., Liu, A. T., & Lee, H.-Y. (2020) · Interspeech (USB) · doi:10.21437/interspeech.2020-2026 · Cited by 34
KAT: A Knowledge Adversarial Training Method for Zero-Order Takagi–Sugeno–Kang Fuzzy Classifiers
Qin, B., Chung, F.-L., & Wang, S. (2020) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2020.3034792 · Cited by 34
Gradient Masking of Label Smoothing in Adversarial Robustness
Lee, H., Bae, H., & Yoon, S. (2020) · IEEE Access · doi:10.1109/access.2020.3048120 · Cited by 36
Face-Off: Adversarial Face Obfuscation
Chandrasekaran, V., Gao, C., Tang, B., Fawaz, K., Jha, S., & Banerjee, S. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0032 · Cited by 40
On the Robustness of Domain Constraints
Sheatsley, R., Hoak, B., Pauley, E., Beugin, Y., Weisman, M. J., & McDaniel, P. D. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484570 · Cited by 43
Exploring Robustness of Unsupervised Domain Adaptation in Semantic Segmentation
Yang, J., Li, C., An, W., Ma, H., Guo, Y., Rong, Y., Zhao, P., & Huang, J. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00906 · Cited by 34
Tian, Y., Pan, J., Yang, S., Zhang, X., He, S., & Jin, Y. (2022) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2022.3168038 · Cited by 34
Understanding Real-world Threats to Deep Learning Models in Android Apps
Deng, Z., Chen, K., Meng, G., Zhang, X., Xu, K. H., & Cheng, Y. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3559388 · Cited by 34
Li, X., Wang, Z., Zhang, B., Sun, F., & Hu, X. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3237935 · Cited by 35
Imperceptible Adversarial Attack via Invertible Neural Networks
Chen, Z., Wang, Z., Huang, J., Zhao, W., Liu, X., & Guan, D. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i1.25115 · Cited by 34
Revisiting Neuron Coverage for DNN Testing: A Layer-Wise and Distribution-Aware Criterion
Yuan, Y., Pang, Q., & Wang, S. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00107 · Cited by 46
Ali, H., Chen, D., Harrington, M., Salazar, N., Ameedi, M. A., Khan, A. F., Butt, A. R., & Cho, J.-H. (2023) · IEEE Access · doi:10.1109/access.2023.3326410 · Cited by 41
Evaluating Deep Learning Based Network Intrusion Detection System in Adversarial Environment
Ye, P., Su, J., Shi, X., & Zhao, B. (2019) · IEEE International Conference on Electronics Information and Emergency Communication · doi:10.1109/iceiec.2019.8784514 · Cited by 34
DeepAuth: A DNN Authentication Framework by Model-Unique and Fragile Signature Embedding
Lao, Y., Zhao, W., Yang, P., & Li, P. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i9.21193 · Cited by 35
Improving Adversarially Robust Few-shot Image Classification with Generalizable Representations
Dong, J., Wang, Y., Lai, J., & Xie, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.00882 · Cited by 33
Robust and Generalized Physical Adversarial Attacks via Meta-GAN
Feng, W., Xu, N., Zhang, T., Wu, B., & Zhang, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3288426 · Cited by 40
Cross-Shaped Adversarial Patch Attack
Ran, Y., Wang, W., Li, M., Li, L.-C., Wang, Y., & Li, J. (2023) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2023.3307150 · Cited by 37
Universal Detection of Backdoor Attacks via Density-Based Clustering and Centroids Analysis
Guo, W., Tondi, B., & Barni, M. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3329426 · Cited by 36
Among Us: Adversarially Robust Collaborative Perception by Consensus
Li, Y., Fang, Q., Bai, J., Chen, S., Juefei-Xu, F., & Feng, C. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00024 · Cited by 45
Energy-Efficient Resource Allocation in Generative AI-Aided Secure Semantic Mobile Networks
Zheng, J., Du, B., Du, H., Kang, J., Niyato, D. T., & Zhang, H. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3396860 · Cited by 36
Adversarial attacks and defenses on text-to-image diffusion models: A survey
Zhang, C., Hu, M., Li, W., & Wang, L. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102701 · Cited by 40
Black-box adversarial attacks against image quality assessment models
Ran, Y., Zhang, A., Li, M., Tang, W., & Wang, Y. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.125415 · Cited by 39
Open Questions about Generative Adversarial Networks
Odena, A. (2019) · Distill · doi:10.23915/distill.00018 · Cited by 37
How Deep Learning Is Making Information Security More Intelligent
Singla, A., & Bertino, E. (2019) · IEEE Security & Privacy · doi:10.1109/msec.2019.2902347 · Cited by 33
Are Adversarial Robustness and Common Perturbation Robustness Independent Attributes ?
Laugros, A., Caplier, A., & Ospici, M. (2019) · 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW) · doi:10.1109/iccvw.2019.00134 · Cited by 33
Provable Tradeoffs in Adversarially Robust Classification
Dobriban, E., Hassani, H., Hong, D. K., & Robey, A. (2023) · IEEE Transactions on Information Theory · doi:10.1109/tit.2022.3205449 · Cited by 64
Making Adversarial Examples More Transferable and Indistinguishable
Zou, J., Duan, Y., Li, B., Zhang, W., Yu, P., & Pan, Z. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i3.20279 · Cited by 36
Applying of Generative Adversarial Networks for Anomaly Detection in Industrial Control Systems
Alabugin, S. K., & Sokolov, A. N. (2020) · Global Smart Industry Conference (GloSIC) · doi:10.1109/glosic50886.2020.9267878 · Cited by 33
Robustifying models against adversarial attacks by Langevin dynamics
Srinivasan, V., Rohrer, C., Marbán, A., Müller, K., Samek, W., & Nakajima, S. (2021) · Neural Networks · doi:10.1016/j.neunet.2020.12.024 · Cited by 41
An Empirical Study on Correlation between Coverage and Robustness for Deep Neural Networks
Dong, Y., Zhang, P., Wang, J., Liu, S., Sun, J., Hao, J., Wang, X., Wang, L., Dong, J. S., & Dai, T. (2020) · IEEE International Conference on Engineering of Complex Computer Systems (ICECCS) · doi:10.1109/iceccs51672.2020.00016 · Cited by 66
Discover the Unknown Biased Attribute of an Image Classifier
Li, Z., & Xu, C. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01470 · Cited by 39
Maximum and Leaky Maximum Propagation
Fuhl, W., & Jasneci, E. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892955 · Cited by 37
Fine-grained Pseudo-code Generation Method via Code Feature Extraction and Transformer
Yang, G., Zhou, Y., Chen, X., & Yu, C. (2021) · Asia-Pacific Software Engineering Conference (APSEC) · doi:10.1109/apsec53868.2021.00029 · Cited by 36
Adversarial Attacks on Deep Learning Based Power Allocation in a Massive MIMO Network
Manoj, B. R., Sadeghi, M., & Larsson, E. G. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500424 · Cited by 33
CODEs: Chamfer Out-of-Distribution Examples against Overconfidence Issue
Tang, K., Miao, D., Peng, W., Wu, J., Shi, Y., Gu, Z., Tian, Z., & Wang, W. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00119 · Cited by 33
Metadata
- Authors
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A.
- Affiliations
- Massachusetts Institute of Technology (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2017
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1706.06083
- OpenAlex
- W2640329709
- Cited by
- 6,602
- References
- 30
- Citations by year
- 2026: 339 · 2025: 892 · 2024: 1288 · 2023: 1268 · 2022: 1005 · 2021: 880 · 2020: 534 · 2019: 286 · 2018: 95 · 2017: 13
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- DSpace@MIT (Massachusetts Institute of Technology) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1553428, 1111109)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial robustness, adversarial attacks, adversarial examples, robust optimization, deep neural network, security guarantees, adversarial training, image classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
