The DOI matches its DataCite record; 28 of the 30 references it cites were found in a registry or an index.
Towards Deep Learning Models Resistant to Adversarial Attacks
Open accessAbstract
Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. Code and pre-trained models are available at https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial training has proven to be an effective method for defending against adversarial attacks [56].”
From Enhancing the Robustness of AI-Generated Text Detectors: A Survey (2025) · cites this paper as [56]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Merino et al. [47] draw on Wang and Strong [74]'s canonical distinction between the intrinsic, contextual, accessibility, and representational aspects of datasets when using the above mentioned industry standards ISO/IEC 25012 and ISO/IEC 25024.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“contemporary authors continue to find value in existing data quality characterisations and conceptual structures.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measuredIn the citing paper
“Existing works in privacy-preserving federated learning are mostly developed based on the wellknown privacy-preserving techniques, including: (1) homomorphic encryption (HE), such as Paillier [90], Elgamal [91] and Brakerski-Gentry-Vaikuntanathan cryptosystems [92]; (2) Secure Multiparty Computation (SMC), such as garbled circuits [93] and secret sharing [94]; and (3) differential privacy (DP) [95”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [93]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · 2015 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2015.123 · Cited by 19,741
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
A unified architecture for natural language processing: deep neural networks with multitask learning
Collobert, R., & Weston, J. (2008) · Proceedings of the 25th international conference on Machine learning - ICML '08 · doi:10.1145/1390156.1390177 · Cited by 5,058
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,234
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Research works printed but not linked: 3
- [1][1] Aharon Ben-Tal, Laurent El Ghaoui, and Arkadi Nemirovski. Robust optimization . Princeton University Press, 2009. -
- [11][11] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR) , 2015. -
- [28][28] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014. -
Cited by
Sorted by citations
Items 301–400 of 1,030
Interpreting and Improving Adversarial Robustness of Deep Neural Networks With Neuron Sensitivity
Zhang, C., Liu, A., Liu, X., Xu, Y., Yu, H., Ma, Y., & Li, T. (2020) · IEEE Transactions on Image Processing · doi:10.1109/tip.2020.3042083 · Cited by 120
FedIPR: Ownership Verification for Federated Deep Neural Network Models
Li, B., Fan, L., Gu, H., Li, J., & Yang, Q. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3195956 · Cited by 115
Pixel-Based Image Encryption Without Key Management for Privacy-Preserving Deep Neural Networks
Sirichotedumrong, W., Kinoshita, Y., & Kiya, H. (2019) · IEEE Access · doi:10.1109/access.2019.2959017 · Cited by 105
Interpretable and Trustworthy Deepfake Detection via Dynamic Prototypes
Trinh, L., Tsang, M., Rambhatla, S., & Liu, Y. (2021) · 2021 IEEE Winter Conference on Applications of Computer Vision (WACV) · doi:10.1109/wacv48630.2021.00202 · Cited by 115
Universal Adversarial Attacks on Text Classifiers
Behjati, M., Moosavi-Dezfooli, S.-M., Baghshah, M. S., & Frossard, P. (2019) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2019.8682430 · Cited by 105
Detecting botnet by using particle swarm optimization algorithm based on voting system
Asadi, M., Jamali, M. A. J., Parsa, S. A., & Majidnezhad, V. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.01.055 · Cited by 108
Robust Optimization as Data Augmentation for Large-scale Graphs
Kong, K., Li, G., Ding, M., Wu, Z., Zhu, C., Ghanem, B., Taylor, G., & Goldstein, T. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.00016 · Cited by 160
Privacy and Security of Big Data in AI Systems: A Research and Standards Perspective
Dilmaghani, S., Brust, M. R., Danoy, G., Cassagnes, N., Pecero, J., & Bouvry, P. (2019) · 2019 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata47090.2019.9006283 · Cited by 111
Green learning: Introduction, examples and outlook
Kuo, C. ‐. J., & Madni, A. M. (2022) · Journal of Visual Communication and Image Representation · doi:10.1016/j.jvcir.2022.103685 · Cited by 119
Benchmarking Adversarial Patch Against Aerial Detection
Lian, J., Mei, S., Zhang, S., & Ma, M. (2022) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2022.3225306 · Cited by 109
Structure Invariant Transformation for better Adversarial Transferability
Wang, X., Zhang, Z., & Zhang, J. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00425 · Cited by 116
A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking
Liu, C., Dong, Y., Xiang, W., Yang, X. H., Su, H., Zhu, J., Chen, Y., He, Y., Xue, H., & Zheng, S. (2024) · International Journal of Computer Vision · doi:10.1007/s11263-024-02196-3 · Cited by 162
Boosting Adversarial Transferability by Block Shuffle and Rotation
Wang, K., He, X., Wang, W., & Wang, X. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02297 · Cited by 125
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service
Hanzlik, L., Zhang, Y., Grosse, K., Salem, A., Augustin, M., Michael Backes, A., & Fritz, M. (2021) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw53098.2021.00368 · Cited by 115
Quantum adversarial machine learning
Lu, S., Duan, L., & Deng, D. (2020) · MPG.PuRe (Max Planck Society) · Cited by 105
Towards Security Threats of Deep Learning Systems: A Survey
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3034721 · Cited by 121
Bad Characters: Imperceptible NLP Attacks
Boucher, N., Shumailov, I., Anderson, R., & Papernot, N. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833641 · Cited by 102
Medical Image Segmentation With Limited Supervision: A Review of Deep Network Models
Peng, J., & Wang, Y. (2021) · IEEE Access · doi:10.1109/access.2021.3062380 · Cited by 115
Improving Unsupervised Image Clustering With Robust Learning
Park, S., Han, S., Kim, S., Kim, D., Park, S., Hong, S., & Cha, M. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01210 · Cited by 113
Kim, Y., Park, H., Moitra, A., Bhattacharjee, A., Venkatesha, Y., & Panda, P. (2022) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp43922.2022.9747906 · Cited by 113
Robust Semantic Communications Against Semantic Noise
Hu, Q., Zhang, G., Qin, Z., Cai, Y., Yu, G., & Li, G. Y. (2022) · IEEE Vehicular Technology Conference · doi:10.1109/vtc2022-fall57202.2022.10012843 · Cited by 115
Hickling, T., Aouf, N., & Spencer, P. (2023) · IEEE Transactions on Intelligent Vehicles · doi:10.1109/tiv.2023.3296227 · Cited by 111
Formal Specification for Deep Neural Networks
Seshia, S. A., Desai, A., Dreossi, T., Fremont, D. J., Ghosh, S., Kim, E., Shivakumar, S., Vazquez-Chanlatte, M., & Yue, X. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01090-4_2 · Cited by 100
Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff
Borgnia, E., Cherepanova, V., Fowl, L., Ghiasi, A., Geiping, J., Goldblum, M., Goldstein, T., & Gupta, A. K. (2021) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp39728.2021.9414862 · Cited by 100
Qian, Z., Huang, K., Wang, Q., & Zhang, X.-Y. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.108889 · Cited by 110
Interpreting Adversarial Examples in Deep Learning: A Review
Han, S., Lin, C., Shen, C. Q., Wang, Q., & Guan, X. (2023) · ACM Computing Surveys · doi:10.1145/3594869 · Cited by 109
ML-LOO: Detecting Adversarial Examples with Feature Attribution
Yang, P., Chen, J., Hsieh, C., Wang, J.-L., & Jordan, M. I. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i04.6140 · Cited by 106
VeriFi: Towards Verifiable Federated Unlearning
Gao, X., Ma, X., Wang, J., Sun, Y., Li, B., Ji, S., Cheng, P., & Chen, J. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3382321 · Cited by 125
Bridging a Gap in SAR-ATR: Training on Fully Synthetic and Testing on Measured Data
Inkawhich, N., Inkawhich, M. J., Davis, E. K., Majumder, U., Tripp, E. E., Capraro, C., & Chen, Y. (2021) · IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing · doi:10.1109/jstars.2021.3059991 · Cited by 102
Meta Gradient Adversarial Attack
Yuan, Z., Zhang, J., Jia, Y., Tan, C., Xue, T., & Shan, S. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00765 · Cited by 101
Towards Adversarial Malware Detection
Maiorca, D., Biggio, B., & Giacinto, G. (2019) · ACM Computing Surveys · doi:10.1145/3332184 · Cited by 111
A Survey of Adversarial Attack and Defense Methods for Malware Classification in Cyber Security
Yan, S., Ren, J., Wang, W., Sun, L., Zhang, W., & Yu, Q. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3225137 · Cited by 113
StyleAdv: Meta Style Adversarial Training for Cross-Domain Few-Shot Learning
Fu, Y., Xie, Y., Fu, Y., & Jiang, Y. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02354 · Cited by 97
OmniAL: A Unified CNN Framework for Unsupervised Anomaly Localization
Zhao, Y. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00382 · Cited by 104
Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models
Chen, J., Wang, J., Peng, T., Sun, Y., Cheng, P., Ji, S., Ma, X., Li, B., & Song, D. X. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833747 · Cited by 105
A Robust Deep Learning Enabled Semantic Communication System for Text
Peng, X., Qin, Z., Huang, D., Tao, X., Lü, J., Liu, G., & Pan, C. (2022) · Globecom · doi:10.1109/globecom48099.2022.10000901 · Cited by 98
Verifying Neural Networks with Mixed Integer ProgrammingPreprint
Tjeng, V., & Tedrake, R. (2017) · arXiv (Cornell University) · Cited by 97
The Conditional Entropy Bottleneck
Fischer, I. (2020) · Entropy · doi:10.3390/e22090999 · Cited by 102
Mahloujifar, S., Diochnos, D. I., & Mahmoody, M. (2019) · AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) · doi:10.1609/aaai.v33i01.33014536 · Cited by 96
Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark
Xu, Y., & Ghamisi, P. (2022) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2022.3156392 · Cited by 97
Khamaiseh, S. Y., Bagagem, D., Al-Alaj, A., Mancino, M., & Alomari, H. W. (2022) · IEEE Access · doi:10.1109/access.2022.3208131 · Cited by 107
Shape-invariant 3D Adversarial Point Clouds
Huang, Q., Dong, X., Chen, D., Zhou, H., Zhang, W., & Yu, N. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01490 · Cited by 101
A Universal Law of Robustness via Isoperimetry
Bubeck, S., & Sellke, M. (2022) · Journal of the ACM · doi:10.1145/3578580 · Cited by 123
Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers
Joshi, A., Mukherjee, A., Sarkar, S., & Hegde, C. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00487 · Cited by 95
Permuted AdaIN: Reducing the Bias Towards Global Statistics in Image Classification
Nuriel, O., Benaim, S., & Wolf, L. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00936 · Cited by 97
Physical Adversarial Attacks on an Aerial Imagery Object Detector
Du, A., Chen, B., Chin, T.-J., Law, Y. W., Sasdelli, M., Rajasegaran, R., & Campbell, D. T. (2022) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv51458.2022.00385 · Cited by 104
Huang, R., & Li, Y. (2022) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2022.3217060 · Cited by 100
Practical Blind Membership Inference Attack via Differential Comparisons
Hui, B., Yang, Y., Yuan, H., Burlina, P., Gong, N. Z., & Cao, Y. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24293 · Cited by 127
Exploring Frequency Adversarial Attacks for Face Forgery Detection
Jia, S., Ma, C., Yao, T., Yin, B., Ding, S., & Yang, X. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52688.2022.00407 · Cited by 97
Membership Inference Attacks Against Adversarially Robust Deep Learning Models
Song, L., Shokri, R., & Mittal, P. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00021 · Cited by 99
Semantic Robustness of Models of Source Code
Henkel, J., Ramakrishnan, G., Wang, Z., Albarghouthi, A., Jha, S., & Reps, T. (2022) · 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner53432.2022.00070 · Cited by 92
Deep Nets: What have They Ever Done for Vision?
Yuille, A. L., & Liu, C. (2021) · International Journal of Computer Vision · doi:10.1007/s11263-020-01405-z · Cited by 98
Delving Deeper into Anti-Aliasing in ConvNets
Zou, X., Xiao, F., Yu, Z., Li, Y., & Lee, Y. J. (2022) · International Journal of Computer Vision · doi:10.1007/s11263-022-01672-y · Cited by 125
3D Common Corruptions and Data Augmentation
Kar, O. F., Yeo, T., Atanov, A., & Zamir, A. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01839 · Cited by 106
Certified Defenses for Adversarial PatchesPreprint
Chiang, P.-Y., Ni, R., Abdelkader, A., Zhu, C., Studer, C., & Goldstein, T. (2020) · arXiv (Cornell University) · doi:10.3929/ethz-b-000452593 · Cited by 132
Adversarial Learning Attacks on Graph-based IoT Malware Detection Systems
Abusnaina, A., Khormali, A., Alasmary, H., Park, J., Anwar, A., & Mohaisen, A. (2019) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2019.00130 · Cited by 91
Wang, H., Wang, G., Li, Y., Zhang, D., & Lin, L. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00042 · Cited by 91
Towards Risk‐Free Trustworthy Artificial Intelligence: Significance and Requirements
Alzubaidi, L., Al-Sabaawi, A., Bai, J., Dukhan, A., Alkenani, A. H., Al‐Asadi, A., Alwzwazy, H. A., Manoufali, M., Fadhel, M. A., Albahri, A. S., et al. (2023) · International Journal of Intelligent Systems · doi:10.1155/2023/4459198 · Cited by 116
Low Frequency Adversarial PerturbationPreprint
Guo, C., Frank, J. S., & Weinberger, K. Q. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.08758 · Cited by 132
A Survey of Deep Learning-Based Source Image Forensics
Yang, P., Baracchi, D., Ni, R., Zhao, Y., Argenti, F., & Piva, A. (2020) · Journal of Imaging · doi:10.3390/jimaging6030009 · Cited by 117
Adversarial Attacks Against Deep Generative Models on Data: A Survey
Sun, H., Zhu, T., Zhang, Z., Jin, D., Xiong, P., & Zhou, W. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3130903 · Cited by 90
DTA: Physical Camouflage Attacks using Differentiable Transformation Network
Suryanto, N., Kim, Y., Kang, H., Larasati, H. T., Yun, Y., Le, T.-T.-H., Yang, H., Oh, S.-Y., & Kim, H. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01487 · Cited by 90
Robust Data-Driven Detection of Electricity Theft Adversarial Evasion Attacks in Smart Grids
Takiddin, A., Ismail, M., & Serpedin, E. (2022) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2022.3193989 · Cited by 93
Analyzing the Robustness of Nearest Neighbors to Adversarial ExamplesPreprint
Wang, Y., Jha, S., & Chaudhuri, K. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1706.03922 · Cited by 90
Disrupting Image-Translation-Based DeepFake Algorithms with Adversarial Attacks
Yeh, C.-Y., Chen, H.-W., Tsai, S.-L., & Wang, S.-D. (2020) · IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW) · doi:10.1109/wacvw50321.2020.9096939 · Cited by 95
Feature Purification: How Adversarial Training Performs Robust Deep Learning
Allen-Zhu, Z., & Li, Y. (2022) · Annual Symposium on Foundations of Computer Science · doi:10.1109/focs52979.2021.00098 · Cited by 126
Understanding Catastrophic Overfitting in Single-step Adversarial Training
Kim, H., Lee, W., & Lee, J. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16989 · Cited by 97
Towards Robustness of Text-to-SQL Models against Synonym Substitution
Gan, Y., Chen, X., Huang, Q., Purver, M., Woodward, J. R., Xie, J., & Huang, P. (2021) · doi:10.18653/v1/2021.acl-long.195 · Cited by 115
Fooling Thermal Infrared Pedestrian Detectors in Real World Using Small Bulbs
Zhu, X., Li, X., Li, J., Wang, Z., & Hu, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i4.16477 · Cited by 89
T-BFA: T argeted B it- F lip Adversarial Weight A ttack
Rakin, A. S., He, Z., Li, J., Yao, F., Chakrabarti, C., & Fan, D. (2021) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2021.3112932 · Cited by 106
Are Formal Methods Applicable To Machine Learning And Artificial Intelligence?
Krichen, M., Mihoub, A., Alzahrani, M. Y., Adoni, W. Y. H., & Nahhal, T. (2022) · International Conference of Smart Systems and Emerging Technologies (SMARTTECH) · doi:10.1109/smarttech54121.2022.00025 · Cited by 91
Hardware Trojan Detection Using Machine Learning: A Tutorial
Gubbi, K. I., Latibari, B. S., Srikanth, A., Sheaves, T. D., Beheshti-Shirazi, S. A., Sai Manoj, P. D., Rafatirad, S., Sasan, A., Homayoun, H., & Salehi, S. (2023) · ACM Transactions on Embedded Computing Systems · doi:10.1145/3579823 · Cited by 89
APMSA: Adversarial Perturbation Against Model Stealing Attacks
Zhang, J., Peng, S., Gao, Y., Zhang, Z., & Hong, Q. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3246766 · Cited by 89
Security of federated learning with IoT systems: Issues, limitations, challenges, and solutions
Yaacoub, J.-P. A., Noura, H., & Salman, O. (2023) · Internet of Things and Cyber-Physical Systems · doi:10.1016/j.iotcps.2023.04.001 · Cited by 106
Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization
Zhang, J., Huang, Y., Wu, W., & Lyu, M. R.-T. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01575 · Cited by 101
Dong, L., Wang, Z., Wang, T., Guan, W., Gao, H., & Zheng, F. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00016 · Cited by 92
Adversarial Attacks and Defenses Against Deep Neural Networks: A Survey
Ozdag, M. (2018) · Procedia Computer Science · doi:10.1016/j.procs.2018.10.315 · Cited by 95
The Best Defense Is a Good Offense: Adversarial Attacks to Avoid Modulation Detection
Hameed, M. Z., György, A., & Gündüz, D. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3025441 · Cited by 90
Robust Encodings: A Framework for Combating Adversarial Typos
Jones, E., Jia, R., Raghunathan, A., & Liang, P. (2020) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2020.acl-main.245 · Cited by 97
Ranasinghe, K., Naseer, M., Hayat, M., Khan, S. H., & Khan, F. S. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01211 · Cited by 98
Adversarial Robustness under Long-Tailed Distribution
Wu, T., Liu, Z., Huang, Q., Wang, Y., & Lin, D. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00855 · Cited by 92
Robust Natural Language Processing: Recent Advances, Challenges, and Future Directions
Omar, M., Choi, S., Nyang, D., & Mohaisen, A. (2022) · IEEE Access · doi:10.1109/access.2022.3197769 · Cited by 104
Understanding and Enhancing the Transferability of Adversarial ExamplesPreprint
Wu, L., Zhu, Z., Tai, C., & Weinan, E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.09707 · Cited by 133
An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91
An adaptable deep learning-based intrusion detection system to zero-day attacks
Soltani, M., Ousat, B., Siavoshani, M. J., & Jahangir, A. H. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103516 · Cited by 87
Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study
Nguyen, D.-L., Arora, S. S., Wu, Y., & Yang, H. (2020) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw50498.2020.00415 · Cited by 86
An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferability
Chen, B., Yin, J.-L., Chen, S., Chen, B., & Liu, X. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00414 · Cited by 96
Adversarial sample detection for deep neural network through model mutation testingPreprint
Wang, J., DONG, G., Sun, J., Wang, X., & PEIXIN, Z. (2019) · Singapore Management University Institutional Knowledge (InK) (Singapore Management University) · Cited by 96
PuVAE: A Variational Autoencoder to Purify Adversarial Examples
Hwang, U., Park, J., Jang, H., Yoon, S., & Cho, N. I. (2019) · IEEE Access · doi:10.1109/access.2019.2939352 · Cited by 91
Defending and Harnessing the Bit-Flip Based Adversarial Weight Attack
He, Z., Rakin, A. S., Li, J., Chakrabarti, C., & Fan, D. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01410 · Cited by 85
Lipschitz Certificates for Layered Network Structures Driven by Averaged Activation Operators
Combettes, P. L., & Pesquet, J.-C. (2020) · SIAM Journal on Mathematics of Data Science · doi:10.1137/19m1272780 · Cited by 100
Restricted Black-Box Adversarial Attack Against DeepFake Face Swapping
Dong, J., Wang, Y., Lai, J., & Xie, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3266702 · Cited by 93
A Survey of Data Quality Requirements That Matter in ML Development Pipelines
Priestley, M., O’donnell, F., & Simperl, E. (2023) · Journal of Data and Information Quality · doi:10.1145/3592616 · Cited by 86
Data synthesis and adversarial networks: A review and meta-analysis in cancer imaging
Osuala, R. O., Kushibar, K., Garrucho, L., Linardos, A., Szafranowska, Z., Klein, S., Glocker, B., Díaz, O., & Lekadir, K. (2022) · Medical Image Analysis · doi:10.1016/j.media.2022.102704 · Cited by 106
Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations
Peng, Z., Li, S., Chen, G., Zhang, C., Zhu, H., & Xue, M. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01307 · Cited by 84
Anti-DreamBooth: Protecting users from personalized text-to-image synthesis
Le, T. V., Phung, H., Nguyen, T. H., Dao, Q. T., Tran, N., & Tran, A. N. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00202 · Cited by 112
A survey of machine learning techniques in adversarial image forensics
Nowroozi, E., Dehghantanha, A., Parizi, R. M., & Choo, K. R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102092 · Cited by 88
Robust Android Malware Detection System Against Adversarial Attacks Using Q-Learning
Rathore, H., Sahay, S. K., Nikam, P., & Sewak, M. (2020) · Information Systems Frontiers · doi:10.1007/s10796-020-10083-8 · Cited by 83
Explainable deep learning in healthcare: A methodological survey from an attribution view
Jin, D., Sergeeva, E., Weng, W., Chauhan, G., & Szolovits, P. (2022) · WIREs Mechanisms of Disease · doi:10.1002/wsbm.1548 · Cited by 98
A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions
Long, T., Gao, Q., Xu, L., & Zhou, Z. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102847 · Cited by 90
Metadata
- Authors
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A.
- Affiliations
- Massachusetts Institute of Technology (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2017
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1706.06083
- OpenAlex
- W2640329709
- Cited by
- 6,602
- References
- 30
- Citations by year
- 2026: 339 · 2025: 892 · 2024: 1288 · 2023: 1268 · 2022: 1005 · 2021: 880 · 2020: 534 · 2019: 286 · 2018: 95 · 2017: 13
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- DSpace@MIT (Massachusetts Institute of Technology) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1553428, 1111109)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial robustness, adversarial attacks, adversarial examples, robust optimization, deep neural network, security guarantees, adversarial training, image classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
