The DOI matches its DataCite record; 51 of the 57 references it cites were found in a registry or an index.
On Adaptive Attacks to Adversarial Example Defenses
Open accessAbstract
Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that thirteen defenses recently published at ICLR, ICML and NeurIPS---and chosen for illustrative and pedagogical purposes---can be circumvented despite attempting to perform evaluations using adaptive attacks. While prior evaluation papers focused mainly on the end result---showing that a defense was ineffective---this paper focuses on laying out the methodology and the approach necessary to perform an adaptive attack. We hope that these analyses will serve as guidance on how to properly perform adaptive attacks against defenses to adversarial examples, and thus will allow the community to make further progress in building more robust models.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“even for settings where powerful optimization attacks exist, it is extremely easy to build non-robust defenses that thwart any specific attack, and require an adaptive attack evaluation [58].”
From AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024) · cites this paper as [58]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Auto-Encoding Variational Bayes
Kingma, D. P., & Welling, M. (2013) · arXiv · doi:10.48550/arxiv.1312.6114 · Cited by 20,067
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Self-citationBoosting Adversarial Attacks with Momentum
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00957 · Cited by 3,334
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,251
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172
Self-citationChen, P., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140448 · Cited by 1,864
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658
Robustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,513
Flagged first, then by citations
6 of the 57 references couldn’t be matched to a known paper.
Research works printed but not linked: 8
- Bafna, M., Murtagh, J., and Vyas, N. Thwarting adversarial examples: An l0-robust sparse fourier transform. In Advances in Neural Information Processing Systems , pp. 10096-10106, 2018.
- Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pp. 15-26, 2017.
- Dhillon, G. S., Azizzadenesheli, K., Lipton, Z. C., Bernstein, J. D., Kossaifi, J., Khanna, A., and Anandkumar, A. Stochastic activation pruning for robust adversarial defense. In International Conference on Learning Representations , 2018.
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations , 2017.
- Sabour, S., Cao, Y., Faghri, F., and Fleet, D. J. Adversarial manipulation of deep representations. International Conference on Learning Representations , 2016.
- Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014.
- Tramèr, F. and Boneh, D. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems , pp. 5858-5868, 2019.
- Yang, Y., Zhang, G., Katabi, D., and Xu, Z. Me-net: Towards effective adversarial robustness with matrix estimation. In International Conference on Machine Learning , pp. 7025-7034, 2019a.
Cited by
Sorted by citations
Items 101–200 of 486
Omni: automated ensemble with unexpected models against adversarial evasion attack
Shu, R., Xia, T., Williams, L. A., & Menzies, T. (2021) · Empirical Software Engineering · doi:10.1007/s10664-021-10064-8 · Cited by 23
Towards Backdoor Attack on Deep Learning based Time Series Classification
Ding, D., Zhang, M., Huang, Y., Pan, X., Feng, F., Jiang, E., & Yang, M. (2022) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde53745.2022.00100 · Cited by 22
Enhancing Adversarial Robustness for Deep Metric Learning
Zhou, M., & Patel, V. M. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01489 · Cited by 20
Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution DataPreprint
Robey, A., Hassani, H., & Pappas, G. J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.10247 · Cited by 69
CC-CERT: A Probabilistic Approach to Certify General Robustness of Neural Networks
Pautov, M., Tursynbek, N., Munkhoeva, M., Muravev, N., Petiushko, A., & Oseledets, I. V. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20768 · Cited by 19
New Adversarial Image Detection Based on Sentiment Analysis
Wang, Y., Li, T., Li, S., Yuan, X., & Ni, W. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2023.3274538 · Cited by 19
InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle
Xu, M., Zhang, T., Li, Z., & Zhang, D. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3183095 · Cited by 18
Towards Transferable Unrestricted Adversarial Examples with Minimum Changes
Liu, F., Zhang, C., & Change Institutions to: University of Waterloo (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00030 · Cited by 19
Holistic Adversarial Robustness of Deep Learning Models
Chen, P., & Liu, S. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i13.26797 · Cited by 23
Adversarial Attack and Defense in Deep Ranking
Zhou, M., Wang, L., Niu, Z., Zhang, Q., Zheng, N., & Hua, G. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3365699 · Cited by 20
Feature Distillation in Deep Attention Network Against Adversarial Examples
Chen, X., Weng, J., Deng, X., Luo, W., Lan, Y., & Tian, Q. C. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3113342 · Cited by 16
Adversarial Detection by Latent Style Transformations
Wang, S., Nepal, ., Abuadbba, A., Rudolph, C., & Grobler, M. M. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3155975 · Cited by 19
SoK: Anti-Facial Recognition Technology
Wenger, E., Shan, S., Zheng, H.-T., & Zhao, B. Y. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179445 · Cited by 17
Fooling the Image Dehazing Models by First Order Gradient
Gui, J., Cong, X., Peng, C., Tang, Y. Y., & Kwok, J. T.-Y. (2024) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2024.3357987 · Cited by 17
Improved Gradient-Based Adversarial Attacks for Quantized Networks
Gupta, K., & Ajanthan, T. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i6.20637 · Cited by 17
Dompteur: Taming Audio Adversarial ExamplesPreprint
Eisenhofer, T., Schönherr, L., Frank, J., Speckemeier, L., Kolossa, D., & Holz, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.05431 · Cited by 20
Improving Adversarial Robustness Using Proxy Distributions.Preprint
Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., & Mittal, P. (2021) · arXiv (Cornell University) · Cited by 17
Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient DescentPreprint
Bryniarski, O., Hingun, N., Pachuca, P., Wang, V., & Carlini, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.15023 · Cited by 32
Self-citationFoggySight: A Scheme for Facial Lookup Privacy
Evtimov, I., Sturmfels, P., & Kohno, T. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0044 · Cited by 16
Dynamic Metric Learning: Towards a Scalable Metric Space to Accommodate Multiple Semantic Scales
Sun, Y., Zhu, Y., Zhang, Y., Zheng, P., Qiu, X., Zhang, C., & Wei, Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00535 · Cited by 18
Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart
Pang, T., Zhang, H., He, D., Dong, Y., Su, H., Chen, W. R., Zhu, J., & Liu, T. Y. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01479 · Cited by 24
Do Input Gradients Highlight Discriminative Features?Preprint
Shah, H., Jain, P., & Netrapalli, P. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.12781 · Cited by 23
Machine Learning and Cybersecurity: Hype and Reality
Musser, M., & Garriott, A. (2021) · doi:10.51593/2020ca004 · Cited by 16
Explaining Classifiers using Adversarial Perturbations on the Perceptual Ball
Elliott, A. J., Law, S., & Russell, C. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01055 · Cited by 15
Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
Belkhouja, T., & Doppa, J. R. (2022) · Journal of Artificial Intelligence Research · doi:10.1613/jair.1.13543 · Cited by 18
RMLM: A Flexible Defense Framework for Proactively Mitigating Word-level Adversarial Attacks
Wang, Z., Liu, Z., Zheng, X., Su, Q., & Wang, J. (2023) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2023.acl-long.155 · Cited by 16
Adversarial Medical Image With Hierarchical Feature Hiding
Yao, Q., He, Z., Li, Y., Lin, Y., Ma, K., Zheng, Y., & Zhou, S. K. (2023) · IEEE Transactions on Medical Imaging · doi:10.1109/tmi.2023.3335098 · Cited by 17
Efficient Certification of Spatial Robustness
Ruoss, A., Baader, M., Balunović, M., & Vechev, M. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i3.16352 · Cited by 15
Robustness Certification for Point Cloud Models
Lorenz, T., Ruoss, A., Balunović, M., Singh, G., & Vechev, M. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00751 · Cited by 18
Towards Adversarially Robust Deep Image Denoising
Yan, H., Zhang, J., Feng, J., Sugiyama, M., & Tan, V. Y. F. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/211 · Cited by 15
Unity is strength: Improving the detection of adversarial examples with ensemble approaches
Craighero, F., Angaroni, F., Stella, F. A., Damiani, C., Antoniotti, M., & Graudenzi, A. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.126576 · Cited by 15
BlurNet: Defense by Filtering the Feature Maps
Raju, R., & Lipasti, M. H. (2020) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w50199.2020.00016 · Cited by 15
Detecting Adversarial Patch Attacks through Global-local Consistency
Li, B., Xu, J., Wu, S., Ding, S., Li, J., & Huang, F. (2021) · doi:10.1145/3475724.3483606 · Cited by 15
Fairness Through Robustness: Investigating Robustness Disparity in Deep LearningPreprint
Nanda, V., Dooley, S. W., Singla, S., Feizi, S., & Dickerson, J. P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.12621 · Cited by 15
Reducing the Risks of Artificial Intelligence for Military Decision Advantage
Hoffman, W., & Kim, H. M. (2023) · doi:10.51593/2021ca008 · Cited by 16
Shaping Deep Feature Space Towards Gaussian Mixture for Visual Classification
Wan, W., Cheng, Y., Chen, J., Wu, T., Zhong, Y., & Yang, M. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3166879 · Cited by 17
3DVerifier: efficient robustness verification for 3D point cloud models
Mu, R., Ruan, W., Marcolino, L. S., & Ni, Q. (2022) · Machine Learning · doi:10.1007/s10994-022-06235-3 · Cited by 14
Privacy-Preserving Split Learning via Patch Shuffling over Transformers
Yao, D., Xiang, L., Xu, H., Ye, H., & Chen, Y. (2022) · Proceedings · doi:10.1109/icdm54844.2022.00074 · Cited by 14
On Model Outsourcing Adaptive Attacks to Deep Learning Backdoor Defenses
Peng, H., Qiu, H., Ma, H., Wang, S., Fu, A., Al-Sarawi, S. F., Abbott, D., & Gao, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3349869 · Cited by 17
Revisiting the Trade-Off Between Accuracy and Robustness via Weight Distribution of Filters
Wei, X., Zhao, S., & Li, B. H. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3411035 · Cited by 15
Emerging technologies and challenges to nuclear stability
Fetter, S., & Sankaran, J. (2024) · Journal of Strategic Studies · doi:10.1080/01402390.2024.2433766 · Cited by 15
Practical Relative Order Attack in Deep Ranking
Zhou, M., Wang, L., Niu, Z., Zhang, Q., Xu, Y., Zheng, N., & Hua, G. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01610 · Cited by 15
How benign is benign overfitting?Preprint
Sanyal, A., Dokania, P. K., Kanade, V., & Torr, P. H. S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.04028 · Cited by 32
What Doesn't Kill You Makes You Robust(er): Adversarial Training against Poisons and Backdoors.Preprint
Geiping, J., Fowl, L., Somepalli, G., Goldblum, M., Moeller, M., & Goldstein, T. (2021) · arXiv (Cornell University) · Cited by 15
Adversarial Image Color Transformations in Explicit Color Filter Space
Zhao, Z., Liu, Z., & Larson, M. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3275057 · Cited by 16
AdvFAS: A robust face anti-spoofing framework against adversarial examples
Chen, J., Yang, X. H., Yin, H., Ma, M., Chen, B., Peng, J., Guo, Y., Yin, Z., & Su, H. (2023) · Computer Vision and Image Understanding · doi:10.1016/j.cviu.2023.103779 · Cited by 14
An Introduction to Adversarially Robust Deep Learning
Peck, J., Goossens, B., & Saeys, Y. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3331087 · Cited by 16
Kiani, S., Awan, S., Lan, C., Li, F., & Luo, B. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485904 · Cited by 15
Deep Reinforcement Learning Policies Learn Shared Adversarial Features across MDPs
Korkmaz, E. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20684 · Cited by 14
Image Feature Fusion Method Based on Edge Detection
Li, F., Du, X., Zhang, L., & Liu, A. (2023) · Information Technology And Control · doi:10.5755/j01.itc.52.1.31549 · Cited by 13
Geometry-Inspired Top-k Adversarial Perturbations
Tursynbek, N., Petiushko, A., & Oseledets, I. V. (2022) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv51458.2022.00411 · Cited by 12
Error-Correcting Output Codes with Ensemble Diversity for Robust Learning in Neural Networks
Song, Y., Kang, Q., & Tay, W. P. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i11.17169 · Cited by 15
Sato, T., Shen, J., Wang, N., Jia, Y., Lin, X., & Chen, Q. A. (2020) · arXiv (Cornell University) · Cited by 13
FenceBox: A Platform for Defeating Adversarial Examples with Data Augmentation TechniquesPreprint
Qiu, H., Zeng, Y., Zhang, T., Jiang, Y., & Qiu, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.01701 · Cited by 23
On the Certified Robustness for Ensemble Models and BeyondPreprint
Yang, Z., Li, L., Xu, X., Kailkhura, B., Xie, T., & Li, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.10873 · Cited by 27
SoK: Machine Learning GovernancePreprint
Chandrasekaran, V., Jia, H., Thudi, A., Travers, A., Yaghini, M., & Papernot, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.10870 · Cited by 33
Stealthy 3D Poisoning Attack on Video Recognition Models
Xie, S., Yan, Y., & Hong, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3163397 · Cited by 12
Noise Optimization in Artificial Neural Networks
Xiao, L., Zhang, Z., Huang, K., Jiang, J., & Peng, Y. (2024) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2024.3384409 · Cited by 13
Nullius in Explanans: an ethical risk assessment for explainable AI
Nannini, L., Huyskes, D., Panai, E., Pistilli, G., & Tartaro, A. (2024) · Ethics and Information Technology · doi:10.1007/s10676-024-09800-7 · Cited by 16
Ensemble of Key-Based Models: Defense Against Black-Box Adversarial Attacks
MaungMaung, A., & Kiya, H. (2021) · IEEE Global Conference on Consumer Electronics (GCCE) · doi:10.1109/gcce53005.2021.9621775 · Cited by 12
Appearance and Structure Aware Robust Deep Visual Graph Matching: Attack, Defense and Beyond
Ren, Q., Bao, Q., Wang, R., & Yan, J. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01483 · Cited by 12
Al-Maliki, S., Bouanani, F. E., Ahmad, K., Abdallah, M. M., Hoang, D. T., Niyato, D. T., & Al‐Fuqaha, A. (2023) · IEEE Transactions on Reliability · doi:10.1109/tr.2023.3298685 · Cited by 12
Ali, H. M., Khan, M. S., AlGhadhban, A., Alazmi, M., Alzamil, A. A., Al-Utaibi, K. A., & Qadir, J. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103367 · Cited by 12
On The Adversarial Robustness of 3D Point Cloud ClassificationPreprint
Sun, J., Koenig, K., Cao, Y., Chen, Q. A., & Mao, Z. M. (2021) · arXiv (Cornell University) · Cited by 12
Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist NeuronsPreprint
Zhang, B., Cai, T., Zhou, L., He, D., & Wang, L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.05363 · Cited by 13
Shan, S., Ding, W., Wenger, E., Zheng, H.-T., & Zhao, B. Y. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560561 · Cited by 12
FADER: Fast adversarial example rejection
Crecchi, F., Melis, M., Sotgiu, A., Bacciu, D., & Biggio, B. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.10.082 · Cited by 17
EMShepherd: Detecting Adversarial Samples via Side-channel Leakage
Ding, R., Gongye, C., Wang, S., Ding, A. A., & Fei, Y. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3582827 · Cited by 11
Adversarial Robustness by Design Through Analog Computing And Synthetic Gradients
Cappelli, A., Ohana, R., Launay, J., Meunier, L., Poli, I., & Krząkała, F. (2022) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp43922.2022.9746671 · Cited by 11
Improving Model Robustness by Adaptively Correcting Perturbation Levels with Active Queries
Ning, K.-P., Tao, L., Chen, S., & Huang, S.-J. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i10.17106 · Cited by 12
Defending Black-Box Skeleton-Based Human Activity Classifiers
Wang, H., Diao, Y., Tan, Z., & Guo, G. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i2.25352 · Cited by 12
On the robustness of randomized classifiers to adversarial examples
Pinot, R., Meunier, L., Yger, F., Gouy‐Pailler, C., Chevaleyre, Y., & Atif, J. (2022) · Machine Learning · doi:10.1007/s10994-022-06216-6 · Cited by 11
ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial DefensePreprint
Meng, Y., Su, J., O'Kane, J., & Jamshidi, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.00308 · Cited by 11
Voting based ensemble improves robustness of defensive modelsPreprint
Devvrit, D., Cheng, M., Hsieh, C., & Dhillon, I. S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.14031 · Cited by 11
Fu, Y., Yu, Q., Zhang, Y., Wu, S., Ouyang, X., Cox, D., & Lin, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14068 · Cited by 11
Enhance CNN Robustness Against Noises for Classification of 12-Lead ECG with Variable Length
Ma, L., & Liang, L. (2020) · International Conference on Machine Learning and Applications · doi:10.1109/icmla51294.2020.00137 · Cited by 12
Improving Robustness Against Stealthy Weight Bit-Flip Attacks by Output Code Matching
Özdenizci, O., & Legenstein, R. A. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01303 · Cited by 10
Applicability issues of Evasion-Based Adversarial Attacks and Mitigation Techniques
Gupta, K. D., Dasgupta, D., & Akhtar, Z. (2020) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci47803.2020.9308589 · Cited by 10
Sequence Squeezing: A Defense Method Against Adversarial Examples for API Call-Based RNN Variants
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534432 · Cited by 10
Subverting Fair Image Search with Generative Adversarial Perturbations
Ghosh, A., Jagielski, M., & Wilson, C. (2022) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3531146.3533128 · Cited by 11
Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation TechniquesPreprint
Qiu, H., Zeng, Y., Zheng, Q., Zhang, T., Qiu, M., & Memmi, G. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.13712 · Cited by 18
Adversarial Learning in the Cyber Security DomainPreprint
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2020) · arXiv (Cornell University) · Cited by 10
Security and Machine Learning in the Real WorldPreprint
Evtimov, I., Cui, W., Kamar, E. S., Kıcıman, E., Kohno, T., & Li, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.07205 · Cited by 10
Manifold Regularization for Locally Stable Deep Neural NetworksPreprint
Jin, C., & Rinard, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.04286 · Cited by 10
Data-Dependent Randomized SmoothingPreprint
Alfarra, M., Bibi, A., Torr, P. H. S., & Ghanem, B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.04351 · Cited by 10
On the Privacy Effect of Data Enhancement via the Lens of Memorization
Li, X., Li, Q., Hu, Z., & Hu, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3381477 · Cited by 13
Understanding the vulnerability of skeleton-based Human Activity Recognition via black-box attack
Diao, Y., Wang, H., Shao, T., Yang, Y., Zhou, K., Hogg, D., & Wang, M. (2024) · Pattern Recognition · doi:10.1016/j.patcog.2024.110564 · Cited by 14
Defeating Misclassification Attacks Against Transfer Learning
Wu, B. Y., Wang, S., Yuan, X., Wang, C., Rudolph, C., & Yang, X. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3144988 · Cited by 12
aaeCAPTCHA: The Design and Implementation of Audio Adversarial CAPTCHA
Hossen, M. I., & Hei, X. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00034 · Cited by 9
Toward Universal Detection of Adversarial Examples via Pseudorandom Classifiers
Zhu, B., Dong, C., Zhang, Y., Mao, Y., & Zhong, S. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3340889 · Cited by 9
Challenging the Adversarial Robustness of DNNs Based on Error-Correcting Output Codes
Zhang, B., Tondi, B., Lv, X., & Barni, M. (2020) · Security and Communication Networks · doi:10.1155/2020/8882494 · Cited by 9
Model-Agnostic Defense for Lane Detection against Adversarial Attack
Xu, H., Ju, A., & Wagner, D. (2021) · International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) · doi:10.14722/autosec.2021.23032 · Cited by 9
Training Provably Robust Models by Polyhedral Envelope Regularization
Liu, C., Salzmann, M., & Susstrunk, S. E. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3111892 · Cited by 9
On the Detection of Adaptive Adversarial Attacks in Speaker Verification Systems
Chen, Z. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3267619 · Cited by 9
Adversarial Attacks and Defenses for Speaker Identification Systems.Preprint
Joshi, S., Villalba, J., Żelasko, P., Moro-Velázquez, L., & Dehak, N. (2021) · arXiv (Cornell University) · Cited by 9
Automated Discovery of Adaptive Attacks on Adversarial DefensesPreprint
Yao, C., Bielik, P., Tsankov, P., & Vechev, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.11860 · Cited by 10
Fighting Gradients with Gradients: Dynamic Defenses against Adversarial AttacksPreprint
Wang, D., Ju, A., Shelhamer, E., Wagner, D., & Darrell, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.08714 · Cited by 16
Adversarial Visual Robustness by Causal InterventionPreprint
Tang, K., Tao, M., & Zhang, H. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09534 · Cited by 20
Besting the Black-Box: Barrier Zones for Adversarial Example Defense
Mahmood, K., Nguyen, P. H., Nguyen, L. M., Nguyen, T. T., & van Dijk, M. (2021) · IEEE Access · doi:10.1109/access.2021.3138966 · Cited by 11
Non-informative noise-enhanced stochastic neural networks for improving adversarial robustness
Yang, H., Wang, M., Wang, Q., Yu, Z., Jin, G., Zhou, C., & Zhou, Y. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102397 · Cited by 8
Metadata
- Authors
- Tramer, F., Carlini, N., Brendel, W., & Madry, A.
- Affiliations
- Google (United States) (US)
- University of Tübingen (DE)
- ORCID
- Carlini, Nicholas
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2002.08347
- OpenAlex
- W3007305010
- Cited by
- 486
- References
- 57
- Citations by year
- 2025: 31 · 2024: 68 · 2023: 75 · 2022: 76 · 2021: 164 · 2020: 69
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- adversarial examples, adaptive attacks, robustness, adversarial robustness, machine learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
