The DOI matches its DataCite record; 28 of the 30 references it cites were found in a registry or an index.
Towards Deep Learning Models Resistant to Adversarial Attacks
Open accessAbstract
Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. Code and pre-trained models are available at https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial training has proven to be an effective method for defending against adversarial attacks [56].”
From Enhancing the Robustness of AI-Generated Text Detectors: A Survey (2025) · cites this paper as [56]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Existing works in privacy-preserving federated learning are mostly developed based on the wellknown privacy-preserving techniques, including: (1) homomorphic encryption (HE), such as Paillier [90], Elgamal [91] and Brakerski-Gentry-Vaikuntanathan cryptosystems [92]; (2) Secure Multiparty Computation (SMC), such as garbled circuits [93] and secret sharing [94]; and (3) differential privacy (DP) [95”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [93]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Merino et al. [47] draw on Wang and Strong [74]'s canonical distinction between the intrinsic, contextual, accessibility, and representational aspects of datasets when using the above mentioned industry standards ISO/IEC 25012 and ISO/IEC 25024.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“contemporary authors continue to find value in existing data quality characterisations and conceptual structures.”
From A Survey of Data Quality Requirements That Matter in ML Development Pipelines (2023) · cites this paper as [47]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification
He, K., Zhang, X., Ren, S., & Sun, J. (2015) · 2015 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2015.123 · Cited by 19,741
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
A unified architecture for natural language processing: deep neural networks with multitask learning
Collobert, R., & Weston, J. (2008) · Proceedings of the 25th international conference on Machine learning - ICML '08 · doi:10.1145/1390156.1390177 · Cited by 5,058
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,251
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Research works printed but not linked: 3
- [1][1] Aharon Ben-Tal, Laurent El Ghaoui, and Arkadi Nemirovski. Robust optimization . Princeton University Press, 2009. -
- [11][11] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR) , 2015. -
- [28][28] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014. -
Cited by
Sorted by citations
Items 601–700 of 1,030
CD-UAP: Class Discriminative Universal Adversarial Perturbation
Zhang, C., Benz, P., Imtiaz, T., & Kweon, I.-S. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i04.6154 · Cited by 59
Detection of Face Recognition Adversarial Attacks
Massoli, F. V., Carrara, F., Amato, G. M., & Falchi, F. (2020) · Computer Vision and Image Understanding · doi:10.1016/j.cviu.2020.103103 · Cited by 57
ModelDiff: testing-based DNN similarity comparison for model reuse detection
Li, Y., Zhang, Z., Liu, B., Yang, Z., & Liu, Y. (2021) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3460319.3464816 · Cited by 64
RGB Cameras Failures and Their Effects in Autonomous Driving Applications
Ceccarelli, A., & Secci, F. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3156941 · Cited by 56
Sahay, R., Brinton, C. G., & Love, D. J. (2021) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2021.3114154 · Cited by 58
Machine learning in NextG networks via generative adversarial networks
Ayanoglu, E., Davaslioglu, K., & Sagduyu, Y. E. (2022) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2022.3153004 · Cited by 55
Adversarial Robustness of Deep Neural Networks: A Survey from a Formal Verification Perspective
Meng, M. H., Bai, G.-D., Teo, S. G., Hou, Z., Xiao, Y., Lin, Y., & Dong, J.-S. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3179131 · Cited by 99
Automatic Evasion of Machine Learning-Based Network Intrusion Detection Systems
Yan, H., Li, X., Zhang, W., Wang, R., Li, H., Zhao, X., Li, F., & Lin, X. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3247585 · Cited by 61
Defending Against Universal Perturbations With Shared Adversarial Training
Mummadi, C. K., Brox, T., & Metzen, J. H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00503 · Cited by 56
Interpolated Adversarial Training
Lamb, A., Verma, V., Kannala, J., & Bengio, Y. (2019) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3338501.3357369 · Cited by 61
Adaptive iterative attack towards explainable adversarial robustness
Shi, Y., Han, Y., Zhang, Q., & Kuang, X. (2020) · Pattern Recognition · doi:10.1016/j.patcog.2020.107309 · Cited by 56
Zhao, P., Wang, S., Gongye, C., Wang, Y., Fei, Y., & Lin, X. (2019) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1145/3316781.3317825 · Cited by 62
Rigorous Agent Evaluation: An Adversarial Approach to Uncover Catastrophic FailuresPreprint
Uesato, J., Kumar, A., Szepesvári, C., Erez, T., Ruderman, A., Anderson, K., Krishmamurthy, Dvijotham, Heess, N., & Kohli, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.01647 · Cited by 55
SpoC: Spoofing Camera Fingerprints
Cozzolino, D., Thies, J., Rossler, A., Niesner, M., & Verdoliva, L. (2021) · 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw53098.2021.00110 · Cited by 54
Compressive Imaging: Structure, Sampling, Learning
Adcock, B., & Hansen, A. C. (2021) · Cambridge University Press eBooks · doi:10.1017/9781108377447 · Cited by 59
Tao, R., Li, H., Wang, T., Wei, Y., Ding, Y., Jin, B., Zhi, H., Liu, X., & Liu, A. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.02051 · Cited by 54
Dynamic Time Warping Based Adversarial Framework for Time-Series Domain
Belkhouja, T., Yan, Y., & Doppa, J. R. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3224754 · Cited by 61
A Comprehensive Defense Framework Against Model Extraction Attacks
Jiang, W., Li, H., Xu, G., Zhang, T., & Lu, R. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3261327 · Cited by 61
Guesmi, A., Hanif, M. A., Ouni, B., & Shafique, M. (2023) · IEEE Access · doi:10.1109/access.2023.3321118 · Cited by 75
Shi, C., Xu, X., Ji, S., Bu, K., Chen, J., Beyah, R., & Wang, T. (2021) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2021.3071395 · Cited by 63
Gupta, P., & Rahtu, E. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00681 · Cited by 58
Hilbert-Based Generative Defense for Adversarial Examples
Bai, Y., Feng, Y., Wang, Y., Dai, T., Xia, S., & Jiang, Y. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00488 · Cited by 51
Negative Training for Neural Dialogue Response Generation
He, T., & Glass, J. R. (2020) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2020.acl-main.185 · Cited by 59
How Does Noise Help Robustness? Explanation and Exploration under the Neural SDE Framework
Liu, X., Xiao, T., Si, S., Cao, Q., Kumar, S., & Hsieh, C. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00036 · Cited by 54
Untargeted, Targeted and Universal Adversarial Attacks and Defenses on Time Series
Rathore, P., Basak, A., Nistala, S. H., & Runkana, V. (2020) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn48605.2020.9207272 · Cited by 57
Joshi, S., Villalba, J., Zelasko, P., Moro-Velazquez, L., & Dehak, N. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3116438 · Cited by 53
Out-of-Domain Generalization From a Single Source: An Uncertainty Quantification Approach
Peng, X., Qiao, F., & Zhao, L. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3184598 · Cited by 54
Are socially-aware trajectory prediction models really socially-aware?
Saadatnejad, S., Bahari, M., Khorsandi, P., Saneian, M., Moosavi-Dezfooli, S.-M., & Alahi, A. (2022) · Transportation Research Part C Emerging Technologies · doi:10.1016/j.trc.2022.103705 · Cited by 62
Aghaeipoor, F., Sabokrou, M., & Fernández, A. (2023) · IEEE Transactions on Fuzzy Systems · doi:10.1109/tfuzz.2023.3243935 · Cited by 53
Zhu, Z., Zhang, Y., Hai, C., Dong, Y., Zhao, S. G., Ding, W., Zhong, J., & Zheng, S. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02069 · Cited by 58
CLIP2Protect: Protecting Facial Privacy Using Text-Guided Makeup via Adversarial Latent Search
Shamshad, F., Naseer, M., & Nandakumar, K. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01973 · Cited by 53
Improving Adversarial Robustness via Guided Complement Entropy
Chen, H., Liang, J.-H., Chang, S.-C., Pan, J.-Y., Chen, Y., Wei, W., & Juan, D.-C. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00498 · Cited by 57
ES Attack: Model Stealing Against Deep Neural Networks Without Data Hurdles
Yuan, X., Ding, L., Zhang, L., Li, X., & Wu, D. O. (2022) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2022.3147508 · Cited by 56
Liu, S., Setio, A. A. A., Ghesu, F. C., Gibson, E., Grbić, S., Georgescu, B., & Comaniciu, D. (2020) · IEEE Transactions on Medical Imaging · doi:10.1109/tmi.2020.3026261 · Cited by 53
Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
Zizzo, G., Hankin, C., Maffeis, S., & Jones, K. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00121 · Cited by 53
Protein tertiary structure prediction and refinement using deep learning and Rosetta in CASP14
Anishchenko, I. V., Baek, M., Park, H., Hiranuma, N., Kim, D. E., Dauparas, J., Mansoor, S., Humphreys, I. R., & Baker, D. A. (2021) · Proteins Structure Function and Bioinformatics · doi:10.1002/prot.26194 · Cited by 50
Deep image prior based defense against adversarial examples
Dai, T., Feng, Y., Chen, B., Lu, J. J., & Xia, S. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.108249 · Cited by 55
Attack Graph Convolutional Networks by Adding Fake NodesPreprint
Wang, X., Cheng, M., Eaton, J., Hsieh, C., & Wu, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.10751 · Cited by 82
Universal Adversarial Attack Via Enhanced Projected Gradient Descent
Deng, Y., & Karam, L. J. (2020) · Proceedings - International Conference on Image Processing · doi:10.1109/icip40778.2020.9191288 · Cited by 53
FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments
Chernikova, A., & Oprea, A. (2022) · ACM Transactions on Privacy and Security · doi:10.1145/3544746 · Cited by 52
Yu, B., Qi, H., Guo, Q., Juefei-Xu, F., Xie, X., Ma, L., & Zhao, J. (2021) · IEEE Transactions on Reliability · doi:10.1109/tr.2021.3096332 · Cited by 58
Li, Z., Chen, G. (., Chen, C., Zou, Y., & Xu, S. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510181 · Cited by 61
Generalizable Black-Box Adversarial Attack With Meta Learning
Yin, F., Zhang, Y., Wu, B., Feng, Y., Zhang, J., Fan, Y., & Yang, Y. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3194988 · Cited by 61
A Survey on Learning to Reject
Zhang, X.-Y., Xie, G.-S., Li, X., Mei, T., & Liu, C. (2023) · Proceedings of the IEEE · doi:10.1109/jproc.2023.3238024 · Cited by 64
CBA: Contextual Background Attack Against Optical Aerial Detection in the Physical World
Lian, J., Wang, X., Su, Y., Ma, M., & Mei, S. (2023) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2023.3264839 · Cited by 55
CFA: Class-Wise Calibrated Fair Adversarial Training
Wei, Z., Wang, Y., Guo, Y., & Wang, Y. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00792 · Cited by 52
Evasion Attack and Defense on Machine Learning Models in Cyber-Physical Systems: A Survey
Wang, S., Ko, R. K. L., Bai, G., Dong, N., Choi, T., & Zhang, Y. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344808 · Cited by 64
Robust Evaluation of Diffusion-Based Adversarial Purification
Lee, M., & Kim, D. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00019 · Cited by 70
Dual Defense: Adversarial, Traceable, and Invisible Robust Watermarking Against Face Swapping
Zhang, Y., Ye, D., Xie, C., Tang, L., Liao, X., Liu, Z., Chen, C., & Deng, J. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3383648 · Cited by 52
Backdoor Attack With Sparse and Invisible Trigger
Gao, Y., Li, Y., Gong, X., Li, Z., Xia, S., & Wang, Q. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3411936 · Cited by 56
DiffAM: Diffusion-Based Adversarial Makeup Transfer for Facial Privacy Protection
Sun, Y., Yu, L., Xie, H., Li, J., & Zhang, Y. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02321 · Cited by 57
On the Robustness of Deep K-Nearest Neighbors
Sitawarin, C., & Wagner, D. A. (2019) · 2019 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00014 · Cited by 62
Detecting adversarial examples via prediction difference for deep neural networks
Guo, F., Zhao, Q., Li, X., Kuang, X., Zhang, J., Han, Y., & Tan, Y. (2019) · Information Sciences · doi:10.1016/j.ins.2019.05.084 · Cited by 55
Discretization Based Solutions for Secure Machine Learning Against Adversarial Attacks
Panda, P., Chakraborty, I., & Roy, K. (2019) · IEEE Access · doi:10.1109/access.2019.2919463 · Cited by 53
Principal Component Adversarial Example
Zhang, Y., Tian, X., Li, Y., Wang, X., & Tao, D. (2020) · IEEE Transactions on Image Processing · doi:10.1109/tip.2020.2975918 · Cited by 53
Coverage-Guided Testing for Recurrent Neural Networks
Huang, W., Sun, Y., Zhao, X., Sharp, J., Ruan, W., Meng, J., & Huang, X. (2021) · IEEE Transactions on Reliability · doi:10.1109/tr.2021.3080664 · Cited by 55
Toward Robust Sensing for Autonomous Vehicles: An Adversarial Perspective
Modas, A., Sánchez-Matilla, R., Frossard, P., & Cavallaro, A. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2985363 · Cited by 56
Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations
Wei, Z., Wang, Y., Li, A., Mo, Y., & Wang, Y. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3660147 · Cited by 51
Taxonomy of Machine Learning Safety: A Survey and Primer
Mohseni, S., Wang, H., Xiao, C., Yu, Z., Wang, Z., & Yadawa, J. (2023) · ACM Computing Surveys · doi:10.1145/3551385 · Cited by 53
Deepfake Forensics via an Adversarial Game
Zhi, W., Guo, Y., & Zuo, W. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3172845 · Cited by 53
AdvRush: Searching for Adversarially Robust Neural Architectures
Mok, J., Na, B., Choe, H., & Yoon, S. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01210 · Cited by 54
Enhancing Adversarial Training with Second-Order Statistics of Weights
Jin, G., Yi, X., Huang, W., Schewe, S., & Huang, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01484 · Cited by 53
MaxStyle: Adversarial Style Composition for Robust Medical Image Segmentation
Chen, C., Li, Z., Ouyang, C., Sinclair, M. D., Bai, W., & Rueckert, D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-16443-9_15 · Cited by 55
Robust convolutional neural networks against adversarial attacks on medical images
Shi, X., Peng, Y., Chen, Q., Keenan, T. D. L., Thavikulwat, A. T., Lee, S., Tang, Y., Chew, E. Y., Summers, R. M., & Lu, Z. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.108923 · Cited by 52
Deep learning and transfer learning for device-free human activity recognition: A survey
Yang, J., Xu, Y., Cao, H., Zou, H., & Xie, L. (2022) · Journal of Automation and Intelligence · doi:10.1016/j.jai.2022.100007 · Cited by 56
Wang, H., Xiang, Z. J., Miller, D. J., & Kesidis, G. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00015 · Cited by 62
Adversarial attacks on Faster R-CNN object detector
Wang, Y., Wang, K., Zhu, Z., & Wang, F. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.11.051 · Cited by 51
Verifying the Safety of Autonomous Systems with Neural Network Controllers
Ivanov, R., Carpenter, T. J., Weimer, J. E., Alur, R., Pappas, G. J., & Lee, I. (2020) · ACM Transactions on Embedded Computing Systems · doi:10.1145/3419742 · Cited by 59
Wireless Fingerprinting via Deep Learning: The Impact of Confounding Factors
Cekic, M., Gopalakrishnan, S., & Madhow, U. (2021) · Asilomar Conference on Signals, Systems and Computers (ACSSC) · doi:10.1109/ieeeconf53345.2021.9723393 · Cited by 53
Push & Pull: Transferable Adversarial Examples With Attentive Attack
Gao, L., Huang, Z., Song, J., Yang, Y., & Shen, H. T. (2021) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2021.3079723 · Cited by 51
Testing Machine Translation via Referential Transparency
He, P., Meister, C., & Su, Z. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse43902.2021.00047 · Cited by 56
Chen, J., Zhao, Y., Li, Q. L., Feng, X., & Xu, K. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297369 · Cited by 54
Beyond data poisoning in federated learning
Kasyap, H., & Tripathy, S. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.121192 · Cited by 50
Randomized Adversarial Training via Taylor Expansion
Jin, G., Yi, X., Wu, D., Mu, R., & Huang, X. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01578 · Cited by 50
On the Robustness of Large Multimodal Models Against Image Adversarial Attacks
Cui, X., Aparcedo, A., Jang, Y. K., & Lim, S.-N. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02325 · Cited by 76
Interpreting and Evaluating Neural Network Robustness
Yu, F., Qin, Z., Liu, C., Zhao, L., Wang, Y., & Chen, X. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/583 · Cited by 59
Wang, X., Wang, S., Chen, P., Wang, Y., Kulis, B., Lin, X., & Chin, S. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/833 · Cited by 50
Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
Houben, S., Abrecht, S., Akila, M., Bär, A., Brockherde, F., Feifel, P., Fingscheidt, T., Gannamaneni, S. S., Ghobadi, S. E., Hammam, A., et al. (2022) · Springer eBooks · doi:10.1007/978-3-031-01233-4_1 · Cited by 62
Walking on the Edge: Fast, Low-Distortion Adversarial ExamplesPreprint
Zhang, H., Avrithis, Y., Furon, T., & Amsaleg, L. (2019) · HAL · Cited by 47
Walking on the Edge: Fast, Low-Distortion Adversarial Examples
Zhang, H., Avrithis, Y., Furon, T., & Amsaleg, L. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3021899 · Cited by 51
Defending against GAN-based DeepFake Attacks via Transformation-aware Adversarial Faces
Yang, C., Ding, L., Chen, Y., & Li, H. H. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9533868 · Cited by 49
A New Perspective on Stabilizing GANs Training: Direct Adversarial Training
Li, Z., Xia, P., Tao, R., Niu, H., & Li, B. (2022) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2022.3193373 · Cited by 50
Adaptive momentum variance for attention-guided sparse adversarial attacks
Li, C., Yao, W., Wang, H., & Jiang, T. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.108979 · Cited by 48
Towards Robust and Adaptive Motion Forecasting: A Causal Representation Perspective
Liu, Y., Cadei, R., Schweizer, J., Bahmani, S., & Alahi, A. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01657 · Cited by 49
Tu, B., He, W., Li, Q., Peng, Y., & Plaza, A. (2023) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2023.3250450 · Cited by 49
Adversarial examples: attacks and defences on medical deep learning systems
Puttagunta, M. K., Ravi, S., & Babu, C. N. K. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-14702-9 · Cited by 56
Tran, A. T., Zeevi, T., & Payabvash, S. (2025) · BioMedInformatics · doi:10.3390/biomedinformatics5020020 · Cited by 60
Deep Validation: Toward Detecting Real-World Corner Cases for Deep Neural Networks
Wu, W., Xu, H. F., Zhong, S., Lyu, M. R.-T., & King, I. (2019) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2019.00026 · Cited by 47
A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks
Chen, J., Zhou, D., Yi, J., & Gu, Q. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i04.5753 · Cited by 62
Defense Against Adversarial Attacks on Spoofing Countermeasures of ASV
Wu, H., Liu, S., Meng, H. M. L., & Lee, H.-Y. (2020) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp40776.2020.9053643 · Cited by 52
MaxUp: Lightweight Adversarial Training with Data Augmentation Improves Neural Network Training
Gong, C., Ren, T., Ye, M., & Liu, Q. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00250 · Cited by 107
Ensembling with Deep Generative Views
Chai, L., Zhu, J.-Y., Shechtman, E., Isola, P., & Zhang, R. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01475 · Cited by 50
Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack
Ye, L., Cheng, Y., Gao, L., Liu, X., Zhang, Q., & Song, J. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01468 · Cited by 56
Robustness Verification of Tree-based ModelsPreprint
Chen, H., Zhang, H., Si, S., Li, Y., Boning, D. S., & Hsieh, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.03849 · Cited by 53
Jacobian Adversarially Regularized Networks for RobustnessPreprint
Chan, A., Tay, Y., Ong, Y.-S., & Fu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.10185 · Cited by 63
SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domain
Harder, P., Pfreundt, F., Keuper, M., & Keuper, J. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9533442 · Cited by 62
DSRNA: Differentiable Search of Robust Neural Architectures
Hosseini, R., Yang, X., & Xie, P. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00613 · Cited by 50
ImageNet-Patch: A dataset for benchmarking machine learning robustness against adversarial patches
Pintor, M., Angioni, D., Sotgiu, A., Demetrio, L., Demontis, A., Biggio, B., & Roli, F. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.109064 · Cited by 48
Moayeri, M., Pope, P., Balaji, Y., & Feizi, S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01850 · Cited by 58
Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition
Chen, G., Zhao, Z., Song, F., Chen, S., Fan, L., Wang, F., & Wang, J. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3220673 · Cited by 51
Metadata
- Authors
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A.
- Affiliations
- Massachusetts Institute of Technology (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2017
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1706.06083
- OpenAlex
- W2640329709
- Cited by
- 6,602
- References
- 30
- Citations by year
- 2026: 339 · 2025: 892 · 2024: 1288 · 2023: 1268 · 2022: 1005 · 2021: 880 · 2020: 534 · 2019: 286 · 2018: 95 · 2017: 13
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- DSpace@MIT (Massachusetts Institute of Technology) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1553428, 1111109)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- adversarial robustness, adversarial attacks, adversarial examples, robust optimization, deep neural network, security guarantees, adversarial training, image classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
