The DOI matches its DataCite record; 51 of the 57 references it cites were found in a registry or an index.
On Adaptive Attacks to Adversarial Example Defenses
Open accessAbstract
Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that thirteen defenses recently published at ICLR, ICML and NeurIPS---and chosen for illustrative and pedagogical purposes---can be circumvented despite attempting to perform evaluations using adaptive attacks. While prior evaluation papers focused mainly on the end result---showing that a defense was ineffective---this paper focuses on laying out the methodology and the approach necessary to perform an adaptive attack. We hope that these analyses will serve as guidance on how to properly perform adaptive attacks against defenses to adversarial examples, and thus will allow the community to make further progress in building more robust models.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“even for settings where powerful optimization attacks exist, it is extremely easy to build non-robust defenses that thwart any specific attack, and require an adaptive attack evaluation [58].”
From AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024) · cites this paper as [58]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Auto-Encoding Variational Bayes
Kingma, D. P., & Welling, M. (2013) · arXiv · doi:10.48550/arxiv.1312.6114 · Cited by 20,067
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Self-citationBoosting Adversarial Attacks with Momentum
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00957 · Cited by 3,334
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,251
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172
Self-citationChen, P., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140448 · Cited by 1,864
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658
Robustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,513
Flagged first, then by citations
6 of the 57 references couldn’t be matched to a known paper.
Research works printed but not linked: 8
- Bafna, M., Murtagh, J., and Vyas, N. Thwarting adversarial examples: An l0-robust sparse fourier transform. In Advances in Neural Information Processing Systems , pp. 10096-10106, 2018.
- Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pp. 15-26, 2017.
- Dhillon, G. S., Azizzadenesheli, K., Lipton, Z. C., Bernstein, J. D., Kossaifi, J., Khanna, A., and Anandkumar, A. Stochastic activation pruning for robust adversarial defense. In International Conference on Learning Representations , 2018.
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations , 2017.
- Sabour, S., Cao, Y., Faghri, F., and Fleet, D. J. Adversarial manipulation of deep representations. International Conference on Learning Representations , 2016.
- Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014.
- Tramèr, F. and Boneh, D. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems , pp. 5858-5868, 2019.
- Yang, Y., Zhang, G., Katabi, D., and Xu, Z. Me-net: Towards effective adversarial robustness with matrix estimation. In International Conference on Machine Learning , pp. 7025-7034, 2019a.
Cited by
Sorted by citations
Items 201–300 of 486
Towards an Awareness of Time Series Anomaly Detection Models' Adversarial Vulnerability
Tariq, S., Le, B. M., & Woo, S. S. (2022) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3511808.3557073 · Cited by 9
A multi-objective memetic algorithm for automatic adversarial attack optimization design
Sun, J., Yao, W., Jiang, T., & Chen, X. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.126318 · Cited by 8
AFPM: A Low-Cost and Universal Adversarial Defense for Speaker Recognition Systems
Sun, Z., Ren, Y., Huang, Y., Liu, W., & Zhu, H.-L. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3348232 · Cited by 8
Laser-Based LiDAR Spoofing: Effects Validation, Capability Quantification, and Countermeasures
Jin, Z., Ji, X., Cheng, Y., Yang, B., Yan, C., & Xu, W. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3496783 · Cited by 9
Improving Ensemble Robustness by Collaboratively Promoting and Demoting Adversarial Robustness
Bui, A., Le, T., Zhao, H., Montague, P., Vel, O. D., Abraham, T., & Phung, D. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i8.16843 · Cited by 9
Optimal Transport as a Defense Against Adversarial Attacks
Bouniot, Q., Audigier, R., & Loesch, A. (2021) · Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition · doi:10.1109/icpr48806.2021.9413327 · Cited by 9
Adversarial Attack Based on Perturbation of Contour Region to Evade Steganalysis-Based Detection
Na, H., Ryu, G., & Choi, D. (2021) · IEEE Access · doi:10.1109/access.2021.3109602 · Cited by 8
Adversarial Attacks and Defense on Deep Learning Classification Models using YCbCr Color Images
Pestana, C., Akhtar, N., Liu, W., Glance, D., & Mian, A. S. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9533495 · Cited by 10
Denoised Internal Models: A Brain-inspired Autoencoder Against Adversarial Attacks
Liu, K.-Y., Li, X., Lai, Y.-R., Su, H., Wang, J., Guo, C., Xie, H. B., Guan, J., & Zhou, Y. (2022) · Machine Intelligence Research · doi:10.1007/s11633-022-1375-7 · Cited by 9
Ares: A System-Oriented Wargame Framework for Adversarial ML
Ahmed, F., Vaishnavi, P., Eykholt, K., & Rahmati, A. (2022) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw54247.2022.9833895 · Cited by 8
Bounded Adversarial Attack on Deep Content Features
Xu, Q., Tao, G., & Zhang, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01477 · Cited by 8
Reliability Assurance for Deep Neural Network Architectures Against Numerical Defects
Li, L., Zhang, Y., Ren, L., Xiong, Y., & Xie, T. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00156 · Cited by 12
Frequency Centric Defense Mechanisms against Adversarial Examples
Shah, S. B., Raval, P., Khakhi, H., & Raval, M. S. (2021) · doi:10.1145/3475724.3483610 · Cited by 8
Defending against FakeBob Adversarial Attacks in Speaker Verification Systems with Noise-Adding
Chen, Z., Chang, L.-C., Chen, C., Wang, G., & Bi, Z. (2022) · Algorithms · doi:10.3390/a15080293 · Cited by 9
Understanding the Intrinsic Robustness of Image Distributions using Conditional Generative ModelsPreprint
Zhang, X., Chen, J., Gu, Q., & Evans, D. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.00378 · Cited by 10
Imbalanced Gradients: A New Cause of Overestimated Adversarial RobustnessPreprint
Jiang, L., Ma, X., Weng, Z., Bailey, J., & Jiang, Y. (2021) · arXiv (Cornell University) · Cited by 8
TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model SmoothnessPreprint
Yang, Z., Li, L., Xu, X., Zuo, S., Chen, Q., Rubinstein, B. I. P., Zhou, P., Zhang, C., & Li, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.00671 · Cited by 9
Adversarial Training with Rectified RejectionPreprint
Pang, T., Zhang, H., He, D., Dong, Y., Su, H., Chen, W. R., Zhu, J., & Liu, T. (2021) · arXiv (Cornell University) · Cited by 8
AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
Debenedetti, E., Zhang, J., Balunović, M., Beurer-Kellner, L., Fischer, M., & Tramèr, F. (2024) · arXiv · doi:10.48550/arxiv.2406.13352 · Cited by 616
“( 2) even for settings where powerful optimization attacks exist, it is extremely easy to build non-robust defenses that thwart any specific attack, and require an adaptive attack evaluation [53].”
BackgroundSelf-citationMitigating Black-Box Adversarial Attacks via Output Noise Perturbation
Aithal, M. B., & Li, X. (2022) · IEEE Access · doi:10.1109/access.2022.3146198 · Cited by 7
Toward Effective Moving Target Defense Against Adversarial AI
Martin, P., Fan, J., Kim, T., Vesey, K., & Greenwald, L. G. (2021) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom52596.2021.9652915 · Cited by 7
Kim, H., Lee, W., Lee, S., & Lee, J. (2023) · Neural Networks · doi:10.1016/j.neunet.2023.08.024 · Cited by 10
Abdullah, H., Karlekar, A., Prasad, S., Rahman, M. S., Blue, L., Bauer, L. A., Bindschaedler, V., & Traynor, P. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24243 · Cited by 7
Robust Proxy: Improving Adversarial Robustness by Robust Proxy Learning
Lee, H. J., & Yong, M.-R. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3288672 · Cited by 7
Boosting Randomized Smoothing with Variance Reduced Classifiers
Horváth, M. Z., Müller, M. N., Fischer, M., & Vechev, M. (2021) · Repository for Publications and Research Data (ETH Zurich) · doi:10.3929/ethz-b-000592011 · Cited by 7
Imbalanced gradients: a subtle cause of overestimated adversarial robustness
Ma, X., Jiang, L., Huang, H., Weng, Z., Bailey, J., & Jiang, Y. (2023) · Machine Learning · doi:10.1007/s10994-023-06328-7 · Cited by 19
Temporal shuffling for defending deep action recognition models against adversarial attacks
Hwang, J., Zhang, H., Choi, J. H., Hsieh, C., & Lee, J. (2023) · Neural Networks · doi:10.1016/j.neunet.2023.10.033 · Cited by 7
Jalalipour, S., & Rekabdar, B. (2023) · International Conference on Transdisciplinary AI (TransAI) · doi:10.1109/transai60598.2023.00018 · Cited by 7
Abdelnabi, S., & Fritz, M. (2021) · ACM Workshop on Moving Target Defense (MTD) · doi:10.1145/3474370.3485659 · Cited by 7
Tekgul, B. G. A., Wang, S., Marchal, S., & Asokan, N. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17143-7_19 · Cited by 7
SOAR: Second-Order Adversarial RegularizationPreprint
Ma, A., Faghri, F., Papernot, N., & Farahmand, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.01832 · Cited by 7
Boosting the Certified Robustness of L-infinity Distance NetsPreprint
Zhang, B., Du, J., He, D., & Wang, L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.06850 · Cited by 7
Sun, J., Mehra, A., Kailkhura, B., Chen, P., Hendrycks, D., Hamm, J., & Mao, Z. M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2112.00659 · Cited by 20
On the Economics of Adversarial Machine Learning
Merkle, F., Samsinger, M., Schöttle, P., & Pevný, T. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3379829 · Cited by 7
Detect Adversarial Attacks Against Deep Neural Networks With GPU Monitoring
Zoppi, T., & Ceccarelli, A. (2021) · IEEE Access · doi:10.1109/access.2021.3125920 · Cited by 8
Exploring The Landscape of Distributional Robustness for Question Answering Models
Awadalla, A., Wortsman, M., Ilharco, G., Min, S., Magnusson, I., Hajishirzi, H., & Schmidt, L. (2022) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.18653/v1/2022.findings-emnlp.441 · Cited by 20
Enhancing adversarial robustness for deep metric learning via neural discrete adversarial training
Li, C., Zhu, Z., Niu, R., & Zhao, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103899 · Cited by 6
Neural architecture search for adversarial robustness via learnable pruning
Li, Y., Zhao, P., Ding, R., Zhou, T. H., Fei, Y., Xu, X., & Lin, X. (2024) · Frontiers in High Performance Computing · doi:10.3389/fhpcp.2024.1301384 · Cited by 9
Improving Adversarial Training From the Perspective of Class-Flipping Distribution
Zhou, D., Wang, N., Liu, T., & Gao, X. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3540200 · Cited by 6
Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks
Özbulak, U., Anzaku, E. T., Neve, W. D., & Messem, A. V. (2021) · British Machine Vision Conference (BMVC) · doi:10.5244/c.35.231 · Cited by 9
Simple Post-Training Robustness using Test Time Augmentations and Random Forest
Cohen, G., & Giryes, R. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00395 · Cited by 8
A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networks
Hector, K. W., Moëllic, P.-A., Dumont, M., & Dutertre, J.-M. (2022) · IEEE International On-Line Testing Symposium (IOLTS) · doi:10.1109/iolts56730.2022.9897693 · Cited by 6
Certified Defense for Content Based Image Retrieval
Kakizaki, K., Fukuchi, K., & Sakuma, J. (2023) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv56688.2023.00454 · Cited by 6
Detecting Adversarial Examples Using Surrogate Models
Feldšar, B., Mayer, R. L., & Rauber, A. (2023) · Machine Learning and Knowledge Extraction · doi:10.3390/make5040087 · Cited by 7
TREND: Transferability-Based Robust ENsemble Design
Ravikumar, D., Kodge, S., Garg, I., & Roy, K. (2022) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2022.3175172 · Cited by 6
Boundary Defense Against Black-box Adversarial Attacks
Aithal, M. B., & Li, X. (2022) · Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition · doi:10.1109/icpr56361.2022.9956476 · Cited by 6
Adversarial Defense in Aerial Detection
Chen, Y., & Chu, S. (2023) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw59228.2023.00226 · Cited by 6
Adversarial Robustness Across Representation Spaces
Awasthi, P., Yu, G. C., Ferng, C.-S., Tomkins, A., & Juan, D.-C. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00752 · Cited by 7
A Partial Break of the Honeypots Defense to Catch Adversarial AttacksPreprint
Carlini, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.10975 · Cited by 6
Self-citationProvably Robust Detection of Out-of-distribution Data (almost) for freePreprint
Meinke, A., Bitterwolf, J., & Hein, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.04260 · Cited by 14
SEC4SR: A Security Analysis Platform for Speaker RecognitionPreprint
Chen, G., Zhao, Z., Song, F., Chen, S., Fan, L., & Liu, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.01766 · Cited by 8
Bhusal, D., Alam, T., Veerabhadran, M. K., Clifford, M., Rampazzi, S., & Rastogi, N. (2024) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp60621.2024.00010 · Cited by 6
Ju, A., & Wagner, D. (2020) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3411508.3421382 · Cited by 5
DRF: Improving Certified Robustness via Distributional Robustness Framework
Wang, Z., Zhou, Z., & Liu, W. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i14.29504 · Cited by 5
AUCPro: AUC-Oriented Provable Robustness Learning
Bao, S., Xu, Q., Yang, Z., He, Y., Cao, X., & Huang, Q. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3545639 · Cited by 8
Boosting Adversarial Robustness using Feature Level Stochastic Smoothing
Addepalli, S., Jain, S., Sriramanan, G., & Babu, R. V. (2021) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw53098.2021.00019 · Cited by 5
DA3G: Detecting Adversarial Attacks by Analysing Gradients
Schulze, J.-P., Sperl, P., & Böttinger, K. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88418-5_27 · Cited by 8
Detecting chaos in adversarial examples
Déniz, Ó., Pedraza, A., & Bueno, G. (2022) · Chaos Solitons & Fractals · doi:10.1016/j.chaos.2022.112577 · Cited by 5
Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attacks
Han, H., Hu, X., Hao, Y., Xu, K., Dang, P., Wang, Y., Zhao, Y., Du, Z., Guo, Q., Wang, Y., et al. (2023) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2023.3305932 · Cited by 6
Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models
Wang, S., Ji, Z., Xiang, L., Zhang, H., Wang, X., Zhou, C., & Li, B. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23326 · Cited by 5
Raney, A., Bendelac, S., Manville, K., Tan, M., & Yamaguchi, K. (2024) · Assurance and Security for AI-enabled Systems · doi:10.1117/12.3021906 · Cited by 5
Generalized Likelihood Ratio Test for Adversarially Robust Hypothesis Testing
Puranik, B., Madhow, U., & Pedarsani, R. (2022) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2022.3198169 · Cited by 5
Robust Monitor for Industrial IoT Condition Prediction
Zhang, X., Tian, H., Zheng, X., & Zeng, D. D. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3222439 · Cited by 5
UTIO: Universal, Targeted, Imperceptible and Over-the-air Audio Adversarial Example
Zhao, C., Li, Z., Ding, H., & Xi, W. (2023) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads56603.2022.00052 · Cited by 5
Improving adversarial robustness through a curriculum-guided reliable distillation
Li, J., Fang, K., Huang, X., & Yang, J. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103411 · Cited by 6
Yu, Y., & Xu, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00395 · Cited by 7
Physics-Constrained Backdoor Attacks on Power System Fault Localization
Bai, J., Wang, R., & Li, Z. (2023) · IEEE Power Engineering Society General Meeting · doi:10.1109/pesgm52003.2023.10252259 · Cited by 6
A Two-Stage Framework for Ambiguous Classification in Software Engineering
Li, J., Lei, Y., Li, S., Zhou, H., Yu, Y., Jia, Z., Ma, Y., & Wang, T. (2023) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre59848.2023.00070 · Cited by 6
Evading Black-box Classifiers Without Breaking Eggs
Debenedetti, E., Carlini, N., & Tramèr, F. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00027 · Cited by 11
Self-citationAdversarial, yet Friendly Signal Design for Secured Wireless Communication
Seo, J., Park, S., & Kang, J. (2021) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc49053.2021.9417250 · Cited by 5
Recent Advances in Understanding Adversarial Robustness of Deep Neural NetworksPreprint
Bai, T., Luo, J., & Zhao, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.01539 · Cited by 5
Adversarial Evaluation of Multimodal Models under Realistic Gray Box AssumptionPreprint
Evtimov, I., Howes, R., Dolhansky, B., Firooz, H., & Canton-Ferrer, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.12902 · Cited by 7
Spotting adversarial samples for speaker verification by neural vocodersPreprint
Wu, H., Hsu, P., Gao, J., Zhang, S., Huang, S., Kang, J., Wu, Z., Meng, H. M. L., & Lee, H.-Y. (2021) · arXiv (Cornell University) · Cited by 5
Data Quality Matters For Adversarial Training: An Empirical StudyPreprint
Dong, C., Liu, L., & Shang, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.07437 · Cited by 13
Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial AttacksPreprint
Yatsura, M., Metzen, J. H., & Hein, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.01714 · Cited by 5
Towards Evaluating the Robustness of Neural Networks Learned by TransductionPreprint
Chen, J., Wu, X., Guo, Y., Liang, Y., & Jha, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14735 · Cited by 5
Almutairi, S., & Barnawi, A. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.114253 · Cited by 4
XAI: regulatory and ethical aspects
Nannini, L. (2025) · Elsevier eBooks · doi:10.1016/b978-0-44-329135-7.00020-5 · Cited by 4
Kang, X., & Song, B. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107666 · Cited by 4
Strengthening Robustness Under Adversarial Attacks Using Brain Visual Codes
Rakhimberdina, Z., Liu, X., & Murata, T. (2022) · IEEE Access · doi:10.1109/access.2022.3204995 · Cited by 5
Confidence-Aware Training of Smoothed Classifiers for Certified Robustness
Jeong, J., Kim, S., & Shin, J. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i7.25968 · Cited by 5
Enhancing adversarial robustness with randomized interlayer processing
Mohammed, A., Ali, Z. T. M., & Ahmad, I. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.123085 · Cited by 4
Architecture-Agnostic Iterative Black-Box Certified Defense Against Adversarial Patches
Yang, D., Huang, Y., Guo, Q., Juefei-Xu, F., Hu, M., Liu, Y., & Pu, G. (2024) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp48485.2024.10448145 · Cited by 5
Detection Defenses: An Empty Promise against Adversarial Patch Attacks on Optical Flow
Scheurer, E., Schmalfuß, J., Lis, A., & Bruhn, A. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00636 · Cited by 5
Ensemble Adversarial Defenses and Attacks in Speaker Verification Systems
Chen, Z., Li, J., & Chen, C. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3430102 · Cited by 4
HO-FMN: Hyperparameter optimization for fast minimum-norm attacks
Mura, R., Floris, G., Scionis, L., Piras, G., Pintor, M., Demontis, A., Giacinto, G., Biggio, B., & Roli, F. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.128918 · Cited by 4
Random transformations to improve mitigation of query-based black-box attacks
Ali, Z. T. M., Azad, R. M. A., Azad, M. A., Holyhead, J., Rice, I., & Imran, A. S. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.125840 · Cited by 4
Learning adversarially robust kernel ensembles with kernel average pooling
Bashivan, P., Bayat, R., Ibrahim, A., Dehghani, A., & Ren, Y. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.126017 · Cited by 7
Perturb, Attend, Detect, and Localize (PADL): Robust Proactive Image Defense
Bartolucci, F., Masi, I., & Lisanti, G. (2025) · IEEE Access · doi:10.1109/access.2025.3565824 · Cited by 4
A4FL: Federated Adversarial Defense via Adversarial Training and Pruning Against Backdoor Attack
Saeed-uz-zaman, Li, B., Hamid, M., Saleem, M., & Aman, M. (2025) · IEEE Access · doi:10.1109/access.2025.3568275 · Cited by 5
Jia, J., Li, L., Li, X., Wang, N., Cai, B., Zhang, X., & Qiu, P. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3568781 · Cited by 4
GGT: Graph-guided testing for adversarial sample detection of deep neural network
Chen, Z., Wang, R., Xiang, J., Yu, Y., Xia, X., Ji, S., Xuan, Q., & Yang, X. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103710 · Cited by 4
Secure wireless communication via adversarial machine learning: A Priori vs. A Posteriori
Seo, J., Park, S., & Kang, J. (2021) · ICT Express · doi:10.1016/j.icte.2021.06.005 · Cited by 4
Pruning in the Face of Adversaries
Merkle, F., Samsinger, M., & Schöttle, P. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-06427-2_55 · Cited by 4
Yang, C.-H. H., Ahmed, Z., Gu, Y., Szurley, J., Ren, R., Liu, L. L., Stolcke, A., & Bulyko, I. (2022) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp43922.2022.9746230 · Cited by 4
Evaluating Adversarial Robustness of Secret Key-Based Defenses
Ali, Z. T. M., Mohammed, A., & Ahmad, I. (2022) · IEEE Access · doi:10.1109/access.2022.3162874 · Cited by 4
Detection of Adversarial Attacks by Observing Deep Features with Structured Data Algorithms
Puccetti, T., Ceccarelli, A., Zoppi, T., & Bondavalli, A. (2023) · ACM Symposium on Applied Computing · doi:10.1145/3555776.3577629 · Cited by 4
Robust Deep Learning Models against Semantic-Preserving Adversarial Attack
Zhao, Y., Gao, D., Yao, Y., Zhang, Z., Mao, B., & Yao, X. (2023) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn54540.2023.10191198 · Cited by 7
Toward Stronger Textual Attack Detectors
Colombo, P., Picot, M., Noiry, N., Staerman, G., & Piantanida, P. (2023) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.18653/v1/2023.findings-emnlp.35 · Cited by 5
Consistent Valid Physically-Realizable Adversarial Attack Against Crowd-Flow Prediction Models
Ali, H. M., Butt, M. A., Filali, F., Al‐Fuqaha, A., & Qadir, J. (2023) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2023.3343971 · Cited by 5
Metadata
- Authors
- Tramer, F., Carlini, N., Brendel, W., & Madry, A.
- Affiliations
- Google (United States) (US)
- University of Tübingen (DE)
- ORCID
- Carlini, Nicholas
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2002.08347
- OpenAlex
- W3007305010
- Cited by
- 486
- References
- 57
- Citations by year
- 2025: 31 · 2024: 68 · 2023: 75 · 2022: 76 · 2021: 164 · 2020: 69
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- adversarial examples, adaptive attacks, robustness, adversarial robustness, machine learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
