The DOI matches its DataCite record; 51 of the 57 references it cites were found in a registry or an index.
On Adaptive Attacks to Adversarial Example Defenses
Open accessAbstract
Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that thirteen defenses recently published at ICLR, ICML and NeurIPS---and chosen for illustrative and pedagogical purposes---can be circumvented despite attempting to perform evaluations using adaptive attacks. While prior evaluation papers focused mainly on the end result---showing that a defense was ineffective---this paper focuses on laying out the methodology and the approach necessary to perform an adaptive attack. We hope that these analyses will serve as guidance on how to properly perform adaptive attacks against defenses to adversarial examples, and thus will allow the community to make further progress in building more robust models.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“even for settings where powerful optimization attacks exist, it is extremely easy to build non-robust defenses that thwart any specific attack, and require an adaptive attack evaluation [58].”
From AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024) · cites this paper as [58]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Auto-Encoding Variational Bayes
Kingma, D. P., & Welling, M. (2013) · arXiv · doi:10.48550/arxiv.1312.6114 · Cited by 20,067
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Self-citationBoosting Adversarial Attacks with Momentum
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00957 · Cited by 3,334
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,251
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172
Self-citationChen, P., Zhang, H., Sharma, Y., Yi, J., & Hsieh, C. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140448 · Cited by 1,864
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658
Robustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,513
Flagged first, then by citations
6 of the 57 references couldn’t be matched to a known paper.
Research works printed but not linked: 8
- Bafna, M., Murtagh, J., and Vyas, N. Thwarting adversarial examples: An l0-robust sparse fourier transform. In Advances in Neural Information Processing Systems , pp. 10096-10106, 2018.
- Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pp. 15-26, 2017.
- Dhillon, G. S., Azizzadenesheli, K., Lipton, Z. C., Bernstein, J. D., Kossaifi, J., Khanna, A., and Anandkumar, A. Stochastic activation pruning for robust adversarial defense. In International Conference on Learning Representations , 2018.
- Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations , 2017.
- Sabour, S., Cao, Y., Faghri, F., and Fleet, D. J. Adversarial manipulation of deep representations. International Conference on Learning Representations , 2016.
- Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR) , 2014.
- Tramèr, F. and Boneh, D. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems , pp. 5858-5868, 2019.
- Yang, Y., Zhang, G., Katabi, D., and Xu, Z. Me-net: Towards effective adversarial robustness with matrix estimation. In International Conference on Machine Learning , pp. 7025-7034, 2019a.
Cited by
Sorted by citations
Items 401–486 of 486
On $\ell_p$-norm Robustness of Ensemble Stumps and TreesPreprint
Wang, Y., Zhang, H., Chen, H., Boning, D. S., & Hsieh, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.08755 · Cited by 1
An Algorithm to Attack Neural Network Encoder-based Out-Of-Distribution Sample DetectorPreprint
Liang, L., Ma, L., Qian, L., & Chen, J. (2020) · arXiv (Cornell University) · Cited by 1
Adversarial robustness via stochastic regularization of neural activation sensitivityPreprint
Fidel, G., Bitton, R., Katzir, Z., & Shabtai, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.11349 · Cited by 2
MaungMaung, A., & Kiya, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.07697 · Cited by 2
With False Friends Like These, Who Can Have Self-Knowledge?Preprint
Tao, L., & Chen, S. (2021) · arXiv (Cornell University) · Cited by 1
Generating Unrestricted Adversarial Examples via Three ParametersPreprint
Naderi, H., Goli, L., & Shohreh Kasaei, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.07640 · Cited by 1
Qin, R., Wang, L., Chen, X., Du, X., & Yan, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.02803 · Cited by 4
Automated Decision-based Adversarial AttacksPreprint
Fu, Q.-A., Dong, Y., Su, H., & Zhu, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.03931 · Cited by 1
Croce, F., & Hein, M. (2021) · arXiv (Cornell University) · Cited by 1
Deep Repulsive Prototypes for Adversarial RobustnessPreprint
Serban, A., Poll, E., & Visser, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.12427 · Cited by 1
Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial TrainingPreprint
Zhou, D., Wang, N., Gao, X., Han, B., Yu, J., Wang, X., & Liu, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.05453 · Cited by 5
ATRAS: Adversarially Trained Robust Architecture SearchPreprint
Alparslan, Y. C., & Kim, E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.06917 · Cited by 2
Who is Responsible for Adversarial Defense?Preprint
Gupta, K. D., & Dasgupta, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.14152 · Cited by 1
Incorporating Label Uncertainty in Understanding Adversarial Robustness.Preprint
Zhang, X. L., & Evans, D. (2021) · arXiv (Cornell University) · Cited by 1
Petersen, E., Potdevin, Y., Mohammadi, E., Zidowitz, S., Breyer, S., Nowotka, D., Henn, S., Pechmann, L., Leucker, M., Rostalski, P., et al. (2021) · arXiv (Cornell University) · Cited by 1
Content-Adaptive Pixel Discretization to Improve Model RobustnessPreprint
Feng, R., Feng, W., & Prakash, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.01699 · Cited by 2
Understanding the Logit Distributions of Adversarially-Trained Deep Neural NetworksPreprint
Seguin, L., Ndirango, A., Mishra, N., Chung, S., & Lee, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.12001 · Cited by 1
Building Compact and Robust Deep Neural Networks with Toeplitz MatricesPreprint
Araujo, A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.00959 · Cited by 1
KATANA: Simple Post-Training Robustness Using Test Time Augmentations.Preprint
Cohen, G., & Giryes, R. (2021) · arXiv (Cornell University) · Cited by 1
Introducing the DOME Activation FunctionsPreprint
Hussein, M. E., & AbdAlmageed, W. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.14798 · Cited by 1
Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial RobustnessPreprint
Yang, X. H., Dong, Y., Xiang, W., Pang, T., Su, H., & Zhu, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08256 · Cited by 1
Adversarial Attacks on ML Defense Models CompetitionPreprint
Dong, Y., Fu, Q.-A., Yang, X. H., Xiang, W., Pang, T., Su, H., Zhu, J., Tang, J., Chen, Y., Mao, X., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08042 · Cited by 4
A Separation Result Between Data-oblivious and Data-aware Poisoning AttacksPreprint
Deng, S., Garg, S., Jha, S., Mahloujifar, S., Mahmoody, M., & Thakurta, A. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.12020 · Cited by 2
Exploring Alignment of Representations with Human PerceptionPreprint
Nanda, V., Majumdar, A., Kolling, C., Dickerson, J. P., Gummadi, K. P., Love, B. C., & Weller, A. (2021) · arXiv (Cornell University) · Cited by 1
AND: Adaptive Noise to Defend Query-Based Black-Box Attacks Without Affecting Normal InferencePreprint
Jia, W., Lu, Z., Yu, R., Li, L., Zhang, H., & Liu, Z. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4596212 · Cited by 1
A Survey on Image Data Perturbations: Challenges, Techniques, and ImpactsPreprint
Zhang, P.-F., Bai, G., Xu, X.-S., & Huang, Z. H. (2025) · doi:10.36227/techrxiv.175037432.26316641/v1 · Cited by 1
Perturbations on the Perceptual BallPreprint
Elliott, A. J., Law, S., & Russell, C. (2019) · arXiv (Cornell University)
Tricking Adversarial Attacks To FailPreprint
Lindqvist, B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.04504
Adversarial Examples and MetricsPreprint
Döttling, N., Grosse, K., Michael Backes, A., & Molloy, I. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.06993
Scalable Inference of Symbolic Adversarial Examples.Preprint
Dimitrov, D. I., Singh, G., Gehr, T., & Vechev, M. (2020) · arXiv (Cornell University)
Semantics-Preserving Adversarial TrainingPreprint
Lee, W., Lee, H., & Lee, S.-G. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.10978 · Cited by 3
Where Does the Robustness Come from?
Liao, C., Cheng, Y., Fang, C., & Shi, J. (2020) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3411508.3421380
A Neuro-Inspired Autoencoding Defense Against Adversarial PerturbationsPreprint
Bakiskan, C., Cekic, M., Sezer, A. D., & Madhow, U. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.10867
Learning to Separate Clusters of Adversarial Representations for Robust Adversarial DetectionPreprint
Joe, B., Hamm, J., Hwang, S. J., Son, S., & Shin, I. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.03483
Yin, X., li, S., & Rohde, G. K. (2021) · arXiv (Cornell University)
Target Training Does Adversarial Training Without Adversarial SamplesPreprint
Lindqvist, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.04836
García, W., Chen, P., Jha, S., Clouse, H. S., & Butler, K. R. B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.03325
Federated Learning without Revealing the Decision BoundariesPreprint
Yousefzadeh, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.00695
Adversarial Feature Stacking for Accurate and Robust Predictions.Preprint
Liu, F., Zhao, R. J., & Shi, L. (2021) · arXiv (Cornell University)
Theoretical Study of Random Noise Defense against Query-Based Black-Box Attacks.Preprint
Qin, Z., Fan, Y., Hongyuan Zha, B., & Wu, B. (2021) · arXiv (Cornell University)
An Ensemble Approach Towards Adversarial RobustnessPreprint
Qian, H. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.05996
Robustifying $\ell_\infty$ Adversarial Training to the Union of Perturbation ModelsPreprint
Patil, A. D., Tuttle, M., Schwing, A. G., & Shanbhag, N. R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.14710 · Cited by 2
Group-Structured Adversarial TrainingPreprint
Farnia, F., Aghazadeh, A., Zou, J., & Tse, D. N. C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.10324
A Guide to Research Frontier of Machine Learning Security
Morikawa, I. (2021) · IEICE ESS FUNDAMENTALS REVIEW · doi:10.1587/essfr.15.1_37
Delving into the pixels of adversarial samplesPreprint
Lindqvist, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.10996
AID-Purifier: A Light Auxiliary Network for Boosting Adversarial DefensePreprint
Hwang, D., Lee, E., & Rhee, W. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.06456
Robustness of Defenses against Deception Attacks
Panum, T. K. (2021) · doi:10.54337/aau429781336
Identifying and Exploiting Structures for Reliable Deep LearningPreprint
Sanyal, A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.07083
Rethinking Clustering for Robustness
Alfarra, M., Pérez, J. C., Bibi, A., Thabet, A., Arbeláez, P., & Ghanem, B. (2021) · British Machine Vision Conference (BMVC) · doi:10.5244/c.35.123 · Cited by 3
Combinatorial Boosting of Ensembles of Diversified Classifiers for Defense Against Evasion Attacks
Izmailov, R., Lin, P., Venkatesan, S., & Sugrim, S. (2021) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom52596.2021.9653040
Towards robust inference against distribution shifts in computer vision
Tang, K. (2021) · DR-NTU (Nanyang Technological University) · doi:10.32657/10356/154119
Detecting Adversarial Samples with Graph-Guided Testing
Chen, Z., Wang, R., Xiang, J., Yu, Y., Xia, X., Ji, S., Xuan, Q., & Yang, X. (2021) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678732
Robust face recognition: How much face Is needed?
Bunzel, N. (2022) · Electronic Imaging · doi:10.2352/ei.2022.34.4.mwsf-209
Guidance Through Surrogate: Toward a Generic Diagnostic Attack
Naseer, M., Khan, S. H., Porikli, F., & Khan, F. S. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3186278
Adversarial Images Against Super-Resolution Convolutional Neural Networks for Free
Rajabi, A., Abbasi, M., Bobba, R. B., & Tajik, K. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0065
Building Compact and Robust Deep Neural Networks with Toeplitz Matrices
Araujo, A. (2021) · theses.fr (ABES) · doi:10.70675/581a32b0zfa99z457ezab3fzd0f62f6fc8d8 · Cited by 1
Adversarial Detection by Approximation of Ensemble BoundaryPreprint
Windeatt, T. (2022) · doi:10.36227/techrxiv.21701936
BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability
Chang, X., Dost, K., Zhao, K., Demontis, A., Roli, F., Dobbie, G., & Wicker, J. S. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-33374-3_1
Beyond NaN: Resiliency of Optimization Layers in the Face of Infeasibility
Wong, W. T., Kinsey, S., Karunasena, R., Nguyen, T. H., & Sinha, A. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i12.26778 · Cited by 1
Image segmentation algorithm based on multi-granularity clustering
Shuyin, X., Cenjun, X., Dai, D., & Ni, J. (2023) · International Conference on Mechatronics and Intelligent Robotics (ICMIR) · doi:10.1117/12.2688915
Fixing Robust Out-of-distribution Detection for Deep Neural Networks
Zhou, Z., Liu, J., Dou, W., Li, S., Kang, L., Qu, M., & Ye, D. (2023) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre59848.2023.00049
Causal Disentanglement for Adversarial Defense
Park, J. Y., Liu, L., Liu, J., & Li, J. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8388-9_26
DAAED: A Deep Autoencoder based Adversarial Example Detection Technique
Kumar, V., & Kumar, M. (2023) · 2023 3rd International Conference on Innovative Sustainable Computational Technologies (CISCT) · doi:10.1109/cisct57197.2023.10351337
An approach to improve transferability of adversarial examples
Zhang, W., & Guo, Y. (2024) · Physical Communication · doi:10.1016/j.phycom.2024.102330
Adversarial Detection by Approximation of Ensemble BoundaryPreprint
Windeatt, T. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4761254
Ma, L., Chen, J., Qian, L., & Liang, L. (2024) · SPIE Medical Imaging: Image Processing · doi:10.1117/12.3006534
Efficient and Robust Classification for Sparse Attacks
Beliaev, M., Delgosha, P., Hassani, H., & Pedarsani, R. (2024) · IEEE Journal on Selected Areas in Information Theory · doi:10.1109/jsait.2024.3397187
Towards resilient cyber networks against adversarial attacks
Chernikova, A. (2024) · doi:10.17760/d20652999
Guerraoui, R., & Pinot, R. (2024) · Springer eBooks · doi:10.1007/978-3-031-54827-7_20
Transcoders: A Better Alternative To Denoising Autoencoders
Gautam, P. R., & Orailoğlu, A. (2024) · IEEE European Test Symposium (ETS) · doi:10.1109/ets61313.2024.10567465
Nowhere to Hide: Toward Robust Reactive Medical Adversarial Defense
Yao, Q., He, Z., Yu, X., & Zhou, S. (2024) · IEEE International Symposium on Biomedical Imaging (ISBI) · doi:10.1109/isbi56570.2024.10635644
Deterministic and Probabilistic Certified Defenses for Content-Based Image Retrieval
Kakizaki, K., Fukuchi, K., & Sakuma, J. (2024) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2023edp7229
Towards an Evaluation Methodology of ML Systems from the Perspective of Robustness and Data Quality
Gala, V. R., Schneider, M., & Vogt, M. (2024) · IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) · doi:10.1109/qrs-c63300.2024.00016
Alchemy: Data-Free Adversarial Training
Bai, Y., Ma, Z., Chen, Y., Deng, J., Pang, S., Liu, Y., & Xu, W. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670395 · Cited by 1
Adversarial detection by approximation of ensemble boundary
Windeatt, T. (2025) · Neurocomputing · doi:10.1016/j.neucom.2025.129364
Localizing Adversarial Attacks To Produces More Imperceptible Noise
Reddy, P., & Gujral, A. S. (2025) · Proceedings of the ... International Florida Artificial Intelligence Research Society Conference · doi:10.32473/flairs.38.1.139004
SEA: Shareable and Explainable Attribution for Query-Based Black-Box Attacks
Gao, Y., Shumailov, I., & Fawaz, K. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00031
Resisting Bag-Based Attribute Profiling by Adding Adversarial Items to Existing Media Profiles
Liu, Z., Zhao, Z., & Larson, M. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3574977
Kim, S., Kim, M., & Chae, D. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8170-9_5
A fast gray-box adversarial example generation algorithm based on FakeBob
Zheng, J., Hou, W., Zhang, H., Lv, M., & Zhou, H. (2025) · High-Confidence Computing · doi:10.1016/j.hcc.2025.100337
Investigating the Transferability of TOG Adversarial Attacks in YOLO Models in the Maritime Domain
Manasut, P., Ibtasham, M. S., Yaradanakul, Z., Azimi, S., Lafond, S., & Iancu, B. (2025) · IEEE Access · doi:10.1109/access.2025.3589512
Reweighting and Cooperative Ensemble Adversarial Training
Li, D., Li, X., Li, Z., & Guo, Y. (2025) · International Conference on Neural Networks, Information and Communication Engineering (NNICE) · doi:10.1109/nnice64954.2025.11063829
(2025) · Elsevier eBooks · doi:10.1016/b978-0-44-324840-5.00019-6
Model safety: adversarial defenses
Jiang, Y., Ma, X., & Wu, Z. (2025) · Elsevier eBooks · doi:10.1016/b978-0-44-324840-5.00014-7
Shahriyar, S. A., Wright, M., & Barton, A. C. (2025) · International Conference on Automatic Face and Gesture Recognition · doi:10.1109/fg61629.2025.11099354
C-SEO Bench: Does Conversational SEO Work?
Puerto, H., Gubri, M., Green, T., Oh, S. J., & Yun, S. (2025) · arXiv · doi:10.48550/arxiv.2506.11097
Metadata
- Authors
- Tramer, F., Carlini, N., Brendel, W., & Madry, A.
- Affiliations
- Google (United States) (US)
- University of Tübingen (DE)
- ORCID
- Carlini, Nicholas
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2002.08347
- OpenAlex
- W3007305010
- Cited by
- 486
- References
- 57
- Citations by year
- 2025: 31 · 2024: 68 · 2023: 75 · 2022: 76 · 2021: 164 · 2020: 69
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- adversarial examples, adaptive attacks, robustness, adversarial robustness, machine learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
