The DOI matches its DataCite record; 28 of the 30 references it cites were found in a registry or an index.
Towards Deep Learning Models Resistant to Adversarial Attacks
Open accessAbstract
Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. Code and pre-trained models are available at https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial training has proven to be an effective method for defending against adversarial attacks [56].”
From Enhancing the Robustness of AI-Generated Text Detectors: A Survey (2025) · cites this paper as [56]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Existing works in privacy-preserving federated learning are mostly developed based on the wellknown privacy-preserving techniques, including: (1) homomorphic encryption (HE), such as Paillier [90], Elgamal [91] and Brakerski-Gentry-Vaikuntanathan cryptosystems [92]; (2) Secure Multiparty Computation (SMC), such as garbled circuits [93] and secret sharing [94]; and (3) differential privacy (DP) [95”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [93]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Merino et al. [47] draw on Wang and Strong [74]'s canonical distinction between the intrinsic, contextual, accessibility, and representational aspects of datasets when using the above mentioned industry standards ISO/IEC 25012 and ISO/IEC 25024.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“contemporary authors continue to find value in existing data quality characterisations and conceptual structures.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · 2015 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2015.123 · Cited by 19,741
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
A unified architecture for natural language processing: deep neural networks with multitask learning
Collobert, R., & Weston, J. (2008) · Proceedings of the 25th international conference on Machine learning - ICML '08 · doi:10.1145/1390156.1390177 · Cited by 5,058
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,251
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Research works printed but not linked: 3
- [1][1] Aharon Ben-Tal, Laurent El Ghaoui, and Arkadi Nemirovski. Robust optimization . Princeton University Press, 2009. -
- [11][11] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR) , 2015. -
- [28][28] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014. -
Cited by
Sorted by citations
Items 201–300 of 1,030
MUTANT: A Training Paradigm for Out-of-Distribution Generalization in Visual Question Answering
Gokhale, T., Banerjee, P., Baral, C. R., & Yang, Y. (2020) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2020.emnlp-main.63 · Cited by 161
Distribution-free, Risk-controlling Prediction Sets
Bates, S., Angelopoulos, A., Lei, L., Malik, J., & Jordan, M. (2021) · Journal of the ACM · doi:10.1145/3478535 · Cited by 144
Macas, M., Wu, C., & Fuertes, W. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122223 · Cited by 175
Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks
Mustafa, A., Khan, S. H., Hayat, M., Goecke, R., Shen, J., & Shao, L. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00348 · Cited by 158
Adversarial XAI Methods in Cybersecurity
Kuppa, A., & Le‐Khac, N. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3117075 · Cited by 151
Trustworthy AI and robotics: Implications for the AEC industry
Emaminejad, N., & Akhavian, R. (2022) · Automation in Construction · doi:10.1016/j.autcon.2022.104298 · Cited by 158
Dataset Distillation: A Comprehensive Review
Yu, R., Liu, S., & Wang, X. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3323376 · Cited by 200
Jain, A. K., Deb, D., & Engelsma, J. J. (2021) · IEEE Transactions on Biometrics Behavior and Identity Science · doi:10.1109/tbiom.2021.3115465 · Cited by 158
Adversarially Adaptive Normalization for Single Domain Generalization
Fan, X., Wang, Q., Ke, J., Yang, F., Gong, B., & Zhou, M. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00811 · Cited by 142
Detecting Adversarial Samples Using Influence Functions and Nearest Neighbors
Cohen, G., Sapiro, G., & Giryes, R. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01446 · Cited by 139
AdvDrop: Adversarial Attack to DNNs by Dropping Information
Duan, R., Chen, Y., Niu, D., Yang, Y., Qin, A. K., & He, Y. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00741 · Cited by 141
Defensive Quantization: When Efficiency Meets RobustnessPreprint
Lin, J., Gan, C., & Han, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1904.08444 · Cited by 190
Training Robust Neural Networks Using Lipschitz Bounds
Pauli, P., Koch, A., Berberich, J., Köhler, P., & Allgöwer, F. (2021) · IEEE Control Systems Letters · doi:10.1109/lcsys.2021.3050444 · Cited by 162
CloudLeak: Large-Scale Deep Learning Models Stealing Through Adversarial Examples
Yu, H., Yang, K., Zhang, T., Tsai, Y.-Y., Ho, T.-Y., & Jin, Y. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24178 · Cited by 144
Adversarial attacks and defenses on AI in medical imaging informatics: A survey
Kaviani, S., Han, K. J., & Sohn, I. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.116815 · Cited by 148
Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification
Cheng, S., Liu, Y., Ma, S., & Zhang, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i2.16201 · Cited by 150
Threats of Adversarial Attacks in DNN-Based Modulation Recognition
Lin, Y., Zhao, H., Tu, Y., Mao, S., & Dou, Z. (2020) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom41043.2020.9155389 · Cited by 136
Shaukat, K., Luo, S., & Varadharajan, V. (2022) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2022.105461 · Cited by 142
CNN-Cert: An Efficient Framework for Certifying Robustness of Convolutional Neural Networks
Boopathy, A., Weng, T.-W., Chen, P., Liu, S., & Daniel, L. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33013240 · Cited by 17
SoK: Certified Robustness for Deep Neural Networks
Li, L., Xie, T., & Li, B. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179303 · Cited by 180
Implicit Generation and Generalization in Energy-Based ModelsPreprint
Du, Y., & Mordatch, I. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.08689 · Cited by 167
Learnable Boundary Guided Adversarial Training
Cui, J., Liu, S., Wang, L., & Jia, J. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01543 · Cited by 141
When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
Fidel, G., Bitton, R., & Shabtai, A. (2020) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn48605.2020.9207637 · Cited by 151
Simulating a Primary Visual Cortex at the Front of CNNs Improves Robustness to Image PerturbationsPreprint
Dapello, J., Marques, T., Schrimpf, M., Geiger, F., Cox, D., & DiCarlo, J. J. (2020) · bioRxiv (Cold Spring Harbor Laboratory) · doi:10.1101/2020.06.16.154542 · Cited by 150
Rob-GAN: Generator, Discriminator, and Adversarial Attacker
Liu, X., & Hsieh, C. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.01149 · Cited by 139
Rademacher Complexity for Adversarially Robust GeneralizationPreprint
Yin, D., Ramchandran, K., & Bartlett, P. L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.11914 · Cited by 154
Lu, S., Tsaknakis, I., Hong, M., & Chen, Y. (2020) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2020.2986363 · Cited by 137
Adversarial Sticker: A Stealthy Attack Method in the Physical World
Wei, X., Guo, Y., & Yu, J. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3176760 · Cited by 155
The Butterfly Effect in artificial intelligence systems: Implications for AI bias and fairness
Ferrara, E. (2024) · Machine Learning with Applications · doi:10.1016/j.mlwa.2024.100525 · Cited by 178
Adversarial examples from computational constraintsPreprint
Bubeck, S., Price, E., & Razenshteyn, I. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.10204 · Cited by 128
Adversarial attack vulnerability of medical image analysis systems: Unexplored factors
Bortsova, G., González-Gonzalo, C., Wetstein, S. C., Dubost, F., Katramados, I., Hogeweg, L., Liefers, B. J., van Ginneken, B., Pluim, J. P. W., Veta, M., et al. (2021) · Medical Image Analysis · doi:10.1016/j.media.2021.102141 · Cited by 139
Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning
Rehman, M. U., Ahmadi, H., & Hassan, W. U. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00139 · Cited by 146
advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchPreprint
Ding, G. W., Wang, L., & Jin, X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.07623 · Cited by 199
Geometry-Aware Generation of Adversarial Point Clouds
Wen, Y., Lin, J., Chen, K., Chen, C. L. P., & Jia, K. (2020) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2020.3044712 · Cited by 143
Efficient Adversarial Training With Transferable Adversarial Examples
Zheng, H., Zhang, Z., Gu, J., Lee, H., & Prakash, A. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00126 · Cited by 129
Nonconvex Min-Max Optimization: Applications, Challenges, and Recent Theoretical Advances
Razaviyayn, M., Huang, T., Lu, S., Nouiehed, M., Sanjabi, M., & Hong, M. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.3003851 · Cited by 131
Communication-Efficient Stochastic Gradient Descent Ascent with Momentum Algorithms
Zhang, Y., Meikang Qiu, A., & Gao, H. (2023) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2023/512 · Cited by 125
Fooling Neural Network Interpretations via Adversarial Model ManipulationPreprint
Heo, J., Joo, S., & Moon, T. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.02041 · Cited by 137
On the Suitability of Lp-Norms for Creating and Preventing Adversarial Examples
Sharif, M., Bauer, L., & Reiter, M. K. (2018) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw.2018.00211 · Cited by 128
Abdullah, H., Warren, K., Bindschaedler, V., Papernot, N., & Traynor, P. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00014 · Cited by 132
Adversarial machine learning for network intrusion detection: A comparative study
Jmila, H., & Khedher, M. I. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109073 · Cited by 132
On Visible Adversarial Perturbations & Digital Watermarking
Hayes, J. (2018) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw.2018.00210 · Cited by 128
Rahman, M. S., Imani, M., Mathews, N., & Wright, M. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3039691 · Cited by 130
Distributionally Adversarial Attack
Zheng, T., Chen, C., & Ren, K. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33012253 · Cited by 130
FDA: Feature Disruptive Attack
Ganeshan, A., Vivek, B. S., & Radhakrishnan, V. B. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00816 · Cited by 129
Robust Pre-Training by Adversarial Contrastive LearningPreprint
Jiang, Z., Chen, T., Chen, T., & Wang, Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.13337 · Cited by 132
CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes
Huang, H., Wang, Y., Chen, Z., Zhang, Y., Li, Y., Tang, Z., Chu, W., Chen, J., Lin, W., & Ma, K. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i1.19982 · Cited by 131
Divergence-Agnostic Unsupervised Domain Adaptation by Adversarial Attacks
Li, J., Du, Z., Zhu, L., Ding, Z., Lü, K., & Shen, H. T. (2021) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2021.3109287 · Cited by 123
Liu, J., Levine, A., Lau, C. P., Chellappa, R., & Feizi, S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01455 · Cited by 121
Scalable agent alignment via reward modeling: a research direction
Leike, J., Krueger, D., Everitt, T., Martic, M., Maini, V., & Legg, S. (2018) · arXiv · doi:10.48550/arxiv.1811.07871 · Cited by 121
Qiao, H., Chen, J., & Huang, X. (2021) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2021.3071312 · Cited by 121
Poison Ink: Robust and Invisible Backdoor Attack
Zhang, J., Chen, D., Huang, Q., Liao, J., Zhang, W., Feng, H., Hua, G., & Yu, N. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3201472 · Cited by 132
Adversarial Examples for Hamming Space Search
Yang, E., Liu, T., Deng, C. D., & Tao, D. (2018) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2018.2882908 · Cited by 121
GFNet: Global Filter Networks for Visual Recognition
Rao, Y., Zhao, W., Zhu, Z. D., Zhou, J., & Lu, J. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3263824 · Cited by 571
Adversarial Attacks on Time Series
Karim, F., Majumdar, S., & Darabi, H. (2021) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2020.2986319 · Cited by 118
Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks
Croce, F., Andriushchenko, M., Singh, N. D., Flammarion, N., & Hein, M. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i6.20595 · Cited by 132
Scaling provable adversarial defensesPreprint
Wong, E., Schmidt, F. R., Metzen, J. H., & Kolter, J. Z. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12514 · Cited by 347
Wang, S., Wang, Q., & Zhao, J. (2020) · Transportation Research Part C Emerging Technologies · doi:10.1016/j.trc.2020.102701 · Cited by 127
Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization
Lee, S., Lee, H., & Yoon, S. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00035 · Cited by 121
Wang, J., & Zhang, H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00673 · Cited by 118
Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation
Huang, P.-S., Stanforth, R., Welbl, J., Dyer, C., Yogatama, D., Gowal, S., Dvijotham, K., & Kohli, P. (2019) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d19-1419 · Cited by 129
Stateful Detection of Black-Box Adversarial Attacks
Chen, S., Carlini, N., & Wagner, D. (2020) · Proceedings of the 1st ACM Workshop on Security and Privacy on Artificial Intelligence · doi:10.1145/3385003.3410925 · Cited by 131
Cheng, G., Sun, X., Li, K., Guo, L., & Han, J. (2021) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2021.3081421 · Cited by 122
DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories
Rakin, A. S., Chowdhuryy, M. H. I., Yao, F., & Fan, D. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833743 · Cited by 117
Cheng, L., Yin, F., Theodoridis, S., Chatzis, S., & Chang, T. (2022) · IEEE Signal Processing Magazine · doi:10.1109/msp.2022.3198201 · Cited by 120
Neural Network Guided Evolutionary Fuzzing for Finding Traffic Violations of Autonomous Vehicles
Zhong, Z., Kaiser, G. E., & Ray, B. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2022.3195640 · Cited by 116
Sign-OPT: A Query-Efficient Hard-label Adversarial AttackPreprint
Cheng, M., Singh, S., Chen, P. M., Chen, P., Liu, S., & Hsieh, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.10773 · Cited by 158
How Does Mixup Help With Robustness and Generalization?Preprint
Zhang, L., Deng, Z., Kawaguchi, K., Ghorbani, A., & Zou, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.04819 · Cited by 172
Training Robust Deep Neural Networks via Adversarial Noise Propagation
Liu, A., Liu, X., Yu, H., Zhang, C., Liu, Q., & Tao, D. (2021) · IEEE Transactions on Image Processing · doi:10.1109/tip.2021.3082317 · Cited by 119
Robust Explainability: A tutorial on gradient-based attribution methods for deep neural networks
Nielsen, I. E., Dera, D., Rasool, G., Ramachandran, R. P., & Bouaynaya, N. C. (2022) · IEEE Signal Processing Magazine · doi:10.1109/msp.2022.3142719 · Cited by 135
Adversarial attacks and adversarial robustness in computational pathology
Laleh, N. G., Truhn, D., Veldhuizen, G. P., Han, T., van Treeck, M., Buelow, R. D., Langer, R., Dislich, B., Boor, P., Schulz, V., et al. (2022) · Nature Communications · doi:10.1038/s41467-022-33266-0 · Cited by 137
RAB: Provable Robustness Against Backdoor Attacks
Weber, M., Xu, X., Karlaš, B., Zhang, C., & Li, B. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179451 · Cited by 151
StyleMix: Separating Content and Style for Enhanced Data Augmentation
Hong, M., Choi, J., & Kim, G. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01462 · Cited by 121
Adversarial Defense via Learning to Generate Diverse Attacks
Jang, Y., Zhao, T., Hong, S., & Lee, H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00283 · Cited by 114
Gradient-based Adversarial Attacks against Text Transformers
Guo, C., Sablayrolles, A., Jeǵou, H., & Kiela, D. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.464 · Cited by 139
Chen, Y., Yan, J., Jiang, M., Zhang, T., Zhao, Z., Zhao, W., Zheng, J., Yao, D., Zhang, R., Kendrick, K. M., et al. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3154755 · Cited by 113
Adversarial Attack and Defense: A Survey
Liang, H., He, E., Zhao, Y., Jia, Z., & Li, H. (2022) · Electronics · doi:10.3390/electronics11081283 · Cited by 113
MFAN: Multi-modal Feature-enhanced Attention Networks for Rumor Detection
Zheng, J., Zhang, X., Guo, S., Wang, Q., Zang, W., & Zhang, Y. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/335 · Cited by 114
Deepfake Media Forensics: Status and Future Challenges
Amerini, I., Barni, M., Battiato, S., Bestagini, P., Boato, G., Bruni, V., Caldelli, R., De Natale, F., De Nicola, R., Guarnera, L., et al. (2025) · Journal of Imaging · doi:10.3390/jimaging11030073 · Cited by 113
Reviewing Federated Machine Learning and Its Use in Diseases Prediction
Moshawrab, M., Adda, M., Bouzouane, A., Ibrahim, H., & Raad, A. (2023) · Sensors · doi:10.3390/s23042112 · Cited by 114
Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
Brunner, T., Diehl, F., Le, M. T., & Knoll, A. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00506 · Cited by 122
Diffusion Models for Imperceptible and Transferable Adversarial Attack
Chen, J., Chen, H., Chen, K., Zhang, Y., Zou, Z., & Shi, Z. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3480519 · Cited by 154
Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural NetworkPreprint
Liu, X., Li, Y., Wu, C., & Hsieh, C. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.01279 · Cited by 112
Shen, J., & Robertson, N. M. (2020) · Information Sciences · doi:10.1016/j.ins.2020.11.026 · Cited by 114
Improving the Transferability of Adversarial Samples with Adversarial Transformations
Wu, W., Su, Y., Lyu, M. R.-T., & King, I. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00891 · Cited by 116
The Robust Manifold Defense: Adversarial Training using Generative ModelsPreprint
Jalal, A., Ilyas, A., Daskalakis, C., & Dimakis, A. G. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1712.09196 · Cited by 155
Gradient Shielding: Towards Understanding Vulnerability of Deep Neural Networks
Gu, Z., Hu, W., Zhang, C., Lu, H. D., Yin, L., & Wang, L. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.2996738 · Cited by 111
Realistic Adversarial Data Augmentation for MR Image Segmentation
Chen, C., Qin, C., Qiu, H., Ouyang, C., Wang, S., Chen, L., Tarroni, G., Bai, W., & Rueckert, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-59710-8_65 · Cited by 110
SurFree: a fast surrogate-free black-box attack
Maho, T., Furon, T., & Merrer, E. L. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01029 · Cited by 123
PixMix: Dreamlike Pictures Comprehensively Improve Safety Measures
Hendrycks, D., Zou, A., Mazeika, M., Tang, L., Li, B., Song, D. X., & Steinhardt, J. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01628 · Cited by 128
On the Vulnerability of CNN Classifiers in EEG-Based BCIs
Zhang, X., & Wu, D. (2019) · IEEE Transactions on Neural Systems and Rehabilitation Engineering · doi:10.1109/tnsre.2019.2908955 · Cited by 112
Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNet
Chen, S., He, Z., Sun, C., Yang, J., & Huang, X. (2020) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2020.3033291 · Cited by 114
Survey: Image mixing and deleting for data augmentation
Naveed, H., Anwar, S., Hayat, M., Javed, K., & Mian, A. S. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107791 · Cited by 138
Feng, H., Li, Q., Wang, W. W., Bashir, A. K., Singh, A. K., Xu, J., & Fang, K. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102555 · Cited by 111
Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Better
Zi, B., Zhao, S., Ma, X., & Jiang, Y. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01613 · Cited by 128
MANDA: On Adversarial Example Detection for Network Intrusion Detection System
Wang, N., Chen, Y., Xiao, Y., Hu, Y., Lou, W., & Hou, Y. T. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3148990 · Cited by 110
Addressing Model Vulnerability to Distributional Shifts Over Image Transformation Sets
Volpi, R., & Murino, V. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00807 · Cited by 110
LESSON: Multi-Label Adversarial False Data Injection Attack for Deep Learning Locational Detection
Tian, J., Shen, C. Q., Wang, B., Xia, X., Zhang, M., Lin, C., & Li, Q. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3353302 · Cited by 110
Stealthy Adversarial Perturbations Against Real-Time Video Classification Systems
Li, S., Neupane, A., Paul, S., Song, C., Krishnamurthy, S. V., Chowdhury, A. K. R., & Swami, A. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23202 · Cited by 108
Verification of Neural Network Behaviour: Formal Guarantees for Power System Applications
Venzke, A., & Chatzivasileiadis, S. (2020) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2020.3009401 · Cited by 112
Metadata
- Authors
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A.
- Affiliations
- Massachusetts Institute of Technology (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2017
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1706.06083
- OpenAlex
- W2640329709
- Cited by
- 6,602
- References
- 30
- Citations by year
- 2026: 339 · 2025: 892 · 2024: 1288 · 2023: 1268 · 2022: 1005 · 2021: 880 · 2020: 534 · 2019: 286 · 2018: 95 · 2017: 13
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- DSpace@MIT (Massachusetts Institute of Technology) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1553428, 1111109)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial robustness, adversarial attacks, adversarial examples, robust optimization, deep neural network, security guarantees, adversarial training, image classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
