RobustBench: a standardized adversarial robustness benchmark
Open accessAbstract
As a research community, we are still lacking a systematic understanding of the progress on adversarial robustness which often makes it hard to identify the most promising ideas in training robust models. A key challenge in benchmarking robustness is that its evaluation is often error-prone leading to robustness overestimation. Our goal is to establish a standardized benchmark of adversarial robustness, which as accurately as possible reflects the robustness of the considered models within a reasonable computational budget. To this end, we start by considering the image classification task and introduce restrictions (possibly loosened in the future) on the allowed models. We evaluate adversarial robustness with AutoAttack, an ensemble of white- and black-box attacks, which was recently shown in a large-scale study to improve almost all robustness evaluations compared to the original publications. To prevent overadaptation of new defenses to AutoAttack, we welcome external evaluations based on adaptive attacks, especially where AutoAttack flags a potential overestimation of robustness. Our leaderboard, hosted at https://robustbench.github.io/, contains evaluations of 120+ models and aims at reflecting the current state of the art in image classification on a set of well-defined tasks in $\ell_\infty$- and $\ell_2$-threat models and on common corruptions, with possible extensions in the future. Additionally, we open-source the library https://github.com/RobustBench/robustbench that provides unified access to 80+ robust models to facilitate their downstream applications. Finally, based on the collected models, we analyze the impact of robustness on the performance on distribution shifts, calibration, out-of-distribution detection, fairness, privacy leakage, smoothness, and transferability.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Benchmarks for adversarial robustness also fall in the category of distribution shifts from transformations.
“Benchmarks for adversarial robustness also fall in this category of distribution shifts from transformations (Goodfellow et al., 2015; Croce et al., 2020).”
From WILDS: A Benchmark of in-the-Wild Distribution Shifts (2020) · cites this paper as Croce et al., 2020
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
(2017) · Cited by 11,625 · see citing works
YOLOv4: Optimal Speed and Accuracy of Object Detection
Bochkovskiy, A., Wang, C.-Y., & Liao, H.-Y. M. (2020) · arXiv · doi:10.48550/arxiv.2004.10934 · Cited by 10,307 · see citing works
On the limited memory BFGS method for large scale optimization
Liu, D. C., & Nocedal, J. (1989) · Mathematical Programming · doi:10.1007/bf01589116 · Cited by 8,684 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Zagoruyko, S., & Komodakis, N. (2016) · Procedings of the British Machine Vision Conference 2016 · doi:10.5244/c.30.87 · Cited by 7,244 · see citing works
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Reading digits in natural images with unsupervised feature learning
Netzer, Y. (2024) · doi:10.57702/e7wwo0zk · Cited by 4,261 · see citing works
On calibration of modern neural networks
Guo, C., Pleiss, G., Sun, Y., & Weinberger, K. Q. (2017) · arXiv · doi:10.48550/arxiv.1706.04599 · Cited by 3,435 · see citing works
Describing Textures in the Wild
Cimpoi, M., Maji, S., Kokkinos, I., Mohamed, S., & Vedaldi, A. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.461 · Cited by 2,438 · see citing works
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172 · see citing works
A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
Hendrycks, D., & Gimpel, K. (2016) · arXiv · doi:10.48550/arxiv.1610.02136 · Cited by 1,968 · see citing works
Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks
Katz, G., Barrett, C., Dill, D. L., Julian, K., & Kochenderfer, M. J. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-63387-9_5 · Cited by 1,706 · see citing works
Provable defenses against adversarial examples via the convex outer adversarial polytopePreprint
Wong, E., & Kolter, J. (2017) · International Conference on Machine Learning · doi:10.48550/arxiv.1711.00851 · Cited by 1,658 · see citing works
Theoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019) · arXiv · doi:10.48550/arxiv.1901.08573 · Cited by 1,560 · see citing works
Geirhos, R., Rubisch, P., Michaelis, C., Bethge, M., Wichmann, F. A., & Brendel, W. (2018) · arXiv · doi:10.48550/arxiv.1811.12231 · Cited by 1,490 · see citing works
Fast is better than free: Revisiting adversarial trainingPreprint
Wong, E., Rice, L., & Kolter, J. (2020) · International Conference on Learning Representations · doi:10.48550/arxiv.2001.03994 · Cited by 1,444 · see citing works
Benchmarking Neural Network Robustness to Common Corruptions and Perturbations
Hendrycks, D., & Dietterich, T. (2019) · arXiv · doi:10.48550/arxiv.1903.12261 · Cited by 1,335 · see citing works
The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization
Hendrycks, D., Basart, S., Mu, N., Kadavath, S., Wang, F., Dorundo, E., Desai, R., Zhu, T., Parajuli, S., Guo, M., et al. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00823 · Cited by 1,250 · see citing works
Robustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,240 · see citing works
Certified Adversarial Robustness via Randomized SmoothingPreprint
Cohen, J. M., Rosenfeld, E., & Kolter, J. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.02918 · Cited by 1,172 · see citing works
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacksPreprint
Croce, F., & Hein, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.01690 · Cited by 965 · see citing works
Self-citationAdversarial Examples for Semantic Segmentation and Object Detection
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.153 · Cited by 955 · see citing works
Generating Natural Language Adversarial Examples
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M. B., & Chang, K.-W. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1316 · Cited by 895 · see citing works
Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative ModelsPreprint
Samangouei, P., Kabkab, M., & Chellappa, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.06605 · Cited by 838 · see citing works
The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., & Song, D. (2018) · arXiv · doi:10.48550/arxiv.1802.08232 · Cited by 629 · see citing works
On Evaluating Adversarial RobustnessPreprint
Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Goodfellow, I., Mądry, A., & Kurakin, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.06705 · Cited by 562 · see citing works
Using Pre-Training Can Improve Model Robustness and UncertaintyPreprint
Hendrycks, D., Lee, K., & Mazeika, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09960 · Cited by 531 · see citing works
WILDS: A Benchmark of in-the-Wild Distribution Shifts
Koh, P. W., Sagawa, S., Marklund, H., Xie, S. M., Zhang, M., Balsubramani, A., Hu, W., Yasunaga, M., Phillips, R. L., Gao, I., et al. (2020) · arXiv · doi:10.48550/arxiv.2012.07421 · Cited by 518 · see citing works
Adversarial Examples Improve Image Recognition
Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A., & Le, Q. V. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00090 · Cited by 510 · see citing works
Brown, T. B., Mané, D., Roy, A., Abadi, M., & Gilmer, J. (2017) · arXiv · doi:10.48550/arxiv.1712.09665 · Cited by 509 · see citing works
On Adaptive Attacks to Adversarial Example Defenses
Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020) · arXiv · doi:10.48550/arxiv.2002.08347 · Cited by 486 · see citing works
Thermometer Encoding: One Hot Way To Resist Adversarial Examples
Buckman, J., Roy, A., Raffel, C., & Goodfellow, I. (2018) · International Conference on Learning Representations · Cited by 483 · see citing works
Unlabeled Data Improves Adversarial RobustnessPreprint
Carmon, Y., Raghunathan, A., Schmidt, L., Liang, P., & Duchi, J. C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.13736 · Cited by 440 · see citing works
Adversarial Weight Perturbation Helps Robust GeneralizationPreprint
Wu, D., Xia, S., & Wang, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.05884 · Cited by 390 · see citing works
Technical Report on the CleverHans v2.1.0 Adversarial Examples LibraryPreprint
Papernot, N., Faghri, F., Carlini, N., Goodfellow, I., Feinman, R., Kurakin, A., Xie, C., Sharma, Y., Brown, T., Roy, A., et al. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1610.00768 · Cited by 380 · see citing works
FreeLB: Enhanced Adversarial Training for Natural Language UnderstandingPreprint
Zhu, C., Cheng, Y., Gan, Z., Sun, S., Goldstein, T., & Liu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.11764 · Cited by 352 · see citing works
Evaluating Robustness of Neural Networks with Mixed Integer ProgrammingPreprint
Tjeng, V., Xiao, K., & Tedrake, R. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.07356 · Cited by 327 · see citing works
Adversarial Attacks and Defences Competition
Kurakin, A., Goodfellow, I., Samy Bengio, A., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., Xie, C., et al. (2018) · The Springer series on challenges in machine learning · doi:10.1007/978-3-319-94042-7_11 · Cited by 321 · see citing works
Foolbox v0.8.0: A Python toolbox to benchmark the robustness of machine learning modelsPreprint
Rauber, J., Brendel, W., & Bethge, M. (2017) · arXiv (Cornell University) · Cited by 305 · see citing works
(2017) · doi:10.48550/arxiv.1712.02779 · Cited by 300 · see citing works
Attacks Which Do Not Kill Training Make Adversarial Learning StrongerPreprint
Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M., & Kankanhalli, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11242 · Cited by 267 · see citing works
Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses
Rony, J., Hafemann, L. G., Oliveira, L. S., Ayed, I. B., Sabourin, R., & Granger, É. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00445 · Cited by 251 · see citing works
Robustness via Curvature Regularization, and Vice Versa
Moosavi-Dezfooli, S.-M., Fawzi, A., Uesato, J., & Frossard, P. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00929 · Cited by 245 · see citing works
Privacy Risks of Securing Machine Learning Models against Adversarial Examples
Song, L., Shokri, R., & Mittal, P. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3354211 · Cited by 229 · see citing works
Self-citationSparseFool: A Few Pixels Make a Big Difference
Modas, A., Moosavi-Dezfooli, S.-M., & Pascal Frossard, B. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00930 · Cited by 221 · see citing works
Adversarial Robustness through Local LinearizationPreprint
Qin, C., Martens, J., Gowal, S., Krishnan, D., Dvijotham, K., Fawzi, A., De, S., Stanforth, R., & Kohli, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.02610 · Cited by 218 · see citing works
Measuring Robustness to Natural Distribution Shifts in Image Classification
Taori, R., Dave, A., Shankar, V., Carlini, N., Recht, B., & Schmidt, L. (2020) · arXiv · doi:10.48550/arxiv.2007.00644 · Cited by 206 · see citing works
Motivating the Rules of the Game for Adversarial Example ResearchPreprint
Gilmer, J., Adams, R. P., Goodfellow, I., Andersen, D., & Dahl, G. E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.06732 · Cited by 203 · see citing works
Adversarial Examples Are a Natural Consequence of Test Error in NoisePreprint
Ford, N., Gilmer, J., Carlini, N., & Cubuk, E. D. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.10513 · Cited by 197 · see citing works
Sparse and Imperceivable Adversarial Attacks
Croce, F., & Hein, M. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00482 · Cited by 195 · see citing works
Self-citationDefense Against Adversarial Attacks Using Feature Scattering-based Adversarial TrainingPreprint
Zhang, H., & Wang, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.10764 · Cited by 194 · see citing works
Robust Physical-World Attacks on Machine Learning Models.Preprint
Evtimov, I., Eykholt, K., Fernandes, E., Kohno, T., Li, B., Prakash, A., Rahmati, A., & Song, D. X. (2017) · arXiv (Cornell University) · Cited by 187 · see citing works
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial ExamplesPreprint
Gowal, S., Qin, C., Uesato, J., Mann, T., & Kohli, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.03593 · Cited by 186 · see citing works
Systematic Evaluation of Privacy Risks of Machine Learning ModelsPreprint
Song, L., & Mittal, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.10595 · Cited by 185 · see citing works
Self-citationFawkes: Protecting Privacy against Unauthorized Deep Learning ModelsPreprint
Shan, S., Wenger, E., Zhang, J., Li, H., Zheng, H.-T., & Zhao, B. Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.08327 · Cited by 184 · see citing works
Adversarial Robustness Against the Union of Multiple Perturbation ModelsPreprint
Maini, P., Wong, E., & Kolter, J. (2019) · International Conference on Machine Learning · doi:10.48550/arxiv.1909.04068 · Cited by 182 · see citing works
Bag of Tricks for Adversarial TrainingPreprint
Pang, T., Yang, X. H., Dong, Y., Su, H., & Zhu, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.00467 · Cited by 170 · see citing works
(2020) · International Conference on Learning Representations · Cited by 168 · see citing works
MMA Training: Direct Input Space Margin Maximization through Adversarial TrainingPreprint
Ding, G. W., Sharma, Y., Lui, K. Y. C., & Huang, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.02637 · Cited by 162 · see citing works
Geometry-aware Instance-reweighted Adversarial TrainingPreprint
Zhang, J., Zhu, J., Niu, G., Han, B., Sugiyama, M., & Kankanhalli, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.01736 · Cited by 161 · see citing works
advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchPreprint
Ding, G. W., Wang, L., & Jin, X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.07623 · Cited by 158 · see citing works
Metric Learning for Adversarial RobustnessPreprint
Mao, C., Zhong, Z., Yang, J., Vondrick, C., & Ray, B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.00900 · Cited by 154 · see citing works
Fixing Data Augmentation to Improve Adversarial RobustnessPreprint
Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., & Mann, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.01946 · Cited by 153 · see citing works
Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks
Mustafa, A., Khan, S. H., Hayat, M., Goecke, R., Shen, J., & Shao, L. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00348 · Cited by 153 · see citing works
DEEPSEC: A Uniform Platform for Security Analysis of Deep Learning Model
Ling, X., Ji, S., Zou, J., Wang, J., Wu, C., Li, B., & Wang, T. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00023 · Cited by 152 · see citing works
Evaluating and Understanding the Robustness of Adversarial Logit PairingPreprint
Engstrom, L., Ilyas, A., & Athalye, A. (2018) · arXiv.org · doi:10.48550/arxiv.1807.10272 · Cited by 147 · see citing works
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations
Wong, E., Schmidt, F. R., & Kolter, J. Z. (2019) · arXiv · doi:10.48550/arxiv.1902.07906 · Cited by 145 · cited 1× · see citing works
“It is an active area of research to develop threat models 92 which are more aligned with the human perception such as spatial perturbations [39, 37], Wasserstein93 bounded perturbations [137, 57], perturbations of the image colors [72] or `p-perturbations in the 94 latent space of a neural network [73, 135].”
BackgroundAdversarial training and robustness for multiple perturbations
Tramèr, F., & Boneh, D. (2019) · arXiv · doi:10.48550/arxiv.1904.13000 · Cited by 145 · see citing works
Learnable Boundary Guided Adversarial Training
Cui, J., Liu, S., Wang, L., & Jia, J. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01543 · Cited by 133 · see citing works
Self-Adaptive Training: beyond Empirical Risk MinimizationPreprint
Huang, L., Zhang, C., & Change Institutions to: University of Waterloo (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.10319 · Cited by 128 · see citing works
Understanding and Mitigating the Tradeoff Between Robustness and AccuracyPreprint
Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., & Liang, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.10716 · Cited by 123 · see citing works
Functional Adversarial AttacksPreprint
Laidlaw, C., & Feizi, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.00001 · Cited by 119 · see citing works
Wang, J., & Zhang, H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00673 · Cited by 116 · see citing works
Adversarial Defense via Learning to Generate Diverse Attacks
Jang, Y., Zhao, T., Hong, S., & Lee, H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00283 · Cited by 112 · see citing works
Rethinking Softmax Cross-Entropy Loss for Adversarial RobustnessPreprint
Pang, T., Xu, K., Dong, Y., Du, C., Chen, N., & Zhu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.10626 · Cited by 108 · see citing works
Boosting Adversarial Training with Hypersphere EmbeddingPreprint
Pang, T., Yang, X. H., Dong, Y., Xu, K., Zhu, J., & Su, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.08619 · Cited by 102 · see citing works
ME-Net: Towards Effective Adversarial Robustness with Matrix EstimationPreprint
Yang, Y., Zhang, G., Katabi, D., & Xu, Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.11971 · Cited by 96 · see citing works
Testing Robustness Against Unforeseen AdversariesPreprint
Kaufmann, M., Kang, D. D., Sun, Y. J., Basart, S., Yin, X., Mazeika, M., Arora, A., Dziedzic, A., Boenisch, F., Brown, T., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.08016 · Cited by 87 · see citing works
CINIC-10 Is Not ImageNet or CIFAR-10Preprint
Darlow, L. N., Crowley, E. J., Antoniou, A., & Storkey, A. (2018) · arXiv (Cornell University) · doi:10.7488/ds/2448 · Cited by 86 · see citing works
Perceptual Adversarial Robustness: Defense Against Unseen Threat ModelsPreprint
Laidlaw, C., Singla, S., & Feizi, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.12655 · Cited by 85 · see citing works
DeepRobust: A PyTorch Library for Adversarial Attacks and DefensesPreprint
Li, Y., Jin, W., Xu, H., & Tang, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.06149 · Cited by 80 · see citing works
To be Robust or to be Fair: Towards Fairness in Adversarial TrainingPreprint
Xu, H., Liu, X., Li, Y., Jain, A. K., & Tang, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.06121 · Cited by 76 · see citing works
Analyzing the Robustness of Open-World Machine Learning
Sehwag, V., Bhagoji, A. N., Song, L., Sitawarin, C., Cullina, D., Chiang, M., & Mittal, P. (2019) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3338501.3357372 · Cited by 74 · see citing works
Self-citationMinimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
Croce, F., & Hein, M. (2020) · International Conference on Machine Learning · Cited by 74 · see citing works
Self-citationEnhancing Adversarial Defense by k-Winners-Take-AllPreprint
Xiao, C., Zhong, P., & Zheng, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.10510 · Cited by 73 · see citing works
Exploring misclassifications of robust neural networks to enhance adversarial attacks
Schwinn, L., Raab, R., Nguyen, A., Zanca, D., & Eskofier, B. M. (2023) · Applied Intelligence · doi:10.1007/s10489-023-04532-5 · Cited by 70 · see citing works
Unrestricted Adversarial ExamplesPreprint
Brown, T. B., Carlini, N., Zhang, C., Olsson, C., Christiano, P. F., & Goodfellow, I. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.08352 · Cited by 68 · see citing works
Mixup Inference: Better Exploiting Mixup to Defend Adversarial AttacksPreprint
Pang, T., Xu, K., & Zhu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.11515 · Cited by 63 · see citing works
Adversarial Robustness on In- and Out-Distribution Improves Explainability
Augustin, M., Meinke, A., & Hein, M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58574-7_14 · Cited by 56 · see citing works
Self-citationTransfer of Adversarial Robustness Between Perturbation TypesPreprint
Kang, D., Sun, Y., Brown, T. B., Hendrycks, D., & Steinhardt, J. (2019) · arXiv.org · doi:10.48550/arxiv.1905.01034 · Cited by 55 · see citing works
On the effectiveness of adversarial training against common corruptionsPreprint
Kireev, K., Andriushchenko, M., & Flammarion, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.02325 · Cited by 54 · see citing works
Self-citationLearning perturbation sets for robust machine learningPreprint
Wong, E., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.08450 · Cited by 52 · see citing works
Jacobian Adversarially Regularized Networks for RobustnessPreprint
Chan, A., Tay, Y., Ong, Y.-S., & Fu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.10185 · Cited by 49 · see citing works
An Alternative Surrogate Loss for PGD-based Adversarial TestingPreprint
Gowal, S., Uesato, J., Qin, C., Huang, P.-S., Mann, T., & Kohli, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.09338 · Cited by 47 · see citing works
Brendel, W., Rauber, J., Kurakin, A., Papernot, N., Veliqi, B., Mohanty, S. P., Laurent, F., Salathé, M., Bethge, M., Yu, Y., et al. (2019) · The Springer series on challenges in machine learning · doi:10.1007/978-3-030-29135-8_5 · Cited by 46 · see citing works
Adversarially-Trained Deep Nets Transfer Better: Illustration on Image ClassificationPreprint
Utrera, F., Kravitz, E., Erichson, N. B., Khanna, R., & Mahoney, M. W. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.05869 · Cited by 45 · see citing works
Logit Pairing Methods Can Fool Gradient-Based AttacksPreprint
Mosbach, M., Andriushchenko, M., Trost, T. A., Hein, M., & Klakow, D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.12042 · Cited by 44 · see citing works
Self-citationAre Perceptually-Aligned Gradients a General Property of Robust Classifiers?Preprint
Kaur, S., Cohen, J., & Lipton, Z. C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.08640 · Cited by 39 · see citing works
Advbox: a toolbox to generate adversarial examples that fool neural networksPreprint
Goodman, D., Hao, X., Wang, Y., Yuesheng, W., Junfeng, X., & Zhang, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.05574 · Cited by 39 · see citing works
Adversarial attacks on Copyright Detection Systems
Saadatpanah, P., Shafahi, A., & Goldstein, T. (2019) · arXiv · doi:10.48550/arxiv.1906.07153 · Cited by 36 · see citing works
Quantifying Perceptual Distortion of Adversarial ExamplesPreprint
Jordan, M., Manoj, N. S., Goel, S., & Dimakis, A. G. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.08265 · Cited by 35 · see citing works
Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
Kumari, N., Singh, M., Sinha, A., Machiraju, H., Krishnamurthy, B., & Balasubramanian, V. N. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/385 · Cited by 34 · see citing works
Augmented Lagrangian Adversarial Attacks
Rony, J., Granger, É., Pedersoli, M., & Ayed, I. B. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00764 · Cited by 34 · see citing works
Robustness May Be at Odds with Fairness: An Empirical Study on Class-wise AccuracyPreprint
Benz, P., Zhang, C., Karjauv, A., & Kweon, I. S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.13365 · Cited by 32 · see citing works
secml: A Python Library for Secure and Explainable Machine Learning.Preprint
Melis, M., Demontis, A., Pintor, M., Sotgiu, A., & Biggio, B. (2019) · arXiv (Cornell University) · Cited by 30 · see citing works
Efficient Robust Training via Backward Smoothing
Chen, J., Cheng, Y., Gan, Z., Gu, Q., & Liu, J. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i6.20571 · Cited by 28 · see citing works
Improving Adversarial Robustness Through Progressive HardeningPreprint
Sitawarin, C., Chakraborty, S., & Wagner, D. (2020) · arXiv (Cornell University) · Cited by 26 · see citing works
Kundu, S., Nazemi, M., Beerel, P. A., & Pedram, M. (2021) · Asia and South Pacific Design Automation Conference (ASP-DAC) · doi:10.1145/3394885.3431542 · Cited by 25 · see citing works
Adversarial Interpolation Training: A Simple Approach for Improving Model Robustness
Zhang, H., & Xu, W. H. (2019) · Cited by 20 · see citing works
Improving Adversarial Robustness Using Proxy Distributions.Preprint
Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., & Mittal, P. (2021) · arXiv (Cornell University) · Cited by 17 · see citing works
Self-citationA critique of the DeepSec Platform for Security Analysis of Deep Learning ModelsPreprint
Carlini, N. (2019) · arXiv.org · doi:10.48550/arxiv.1905.07112 · Cited by 16 · see citing works
Fighting Gradients with Gradients: Dynamic Defenses against Adversarial AttacksPreprint
Wang, D., Ju, A., Shelhamer, E., Wagner, D., & Darrell, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.08714 · Cited by 16 · see citing works
Improving the Speed and Quality of GAN by Adversarial TrainingPreprint
Zhong, J., Liu, X., & Hsieh, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.03364 · Cited by 12 · see citing works
Understanding Generalization in Adversarial Training via the Bias-Variance DecompositionPreprint
Yu, Y., Yang, Z., Dobriban, E., Steinhardt, J., & Ma, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.09947 · Cited by 12 · see citing works
An orthogonal classifier for improving the adversarial robustness of neural networks
Xu, C., Li, X., & Yang, M. (2022) · Information Sciences · doi:10.1016/j.ins.2022.01.039 · Cited by 11 · see citing works
Rade, R., & Moosavi-Dezfooli, S.-M. (2021) · International Conference on Machine Learning · Cited by 11 · see citing works
A Critical Evaluation of Open-World Machine LearningPreprint
Song, L., Sehwag, V., Bhagoji, A. N., & Mittal, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.04391 · Cited by 9 · see citing works
Self-citationAdversarial Training with Rectified RejectionPreprint
Pang, T., Zhang, H., He, D., Dong, Y., Su, H., Chen, W. R., Zhu, J., & Liu, T. (2021) · arXiv (Cornell University) · Cited by 8 · see citing works
Kim, J., & Wang, X. (2019) · Cited by 8 · see citing works
Provable Defense Against Delusive PoisoningPreprint
Tao, L., Feng, L., Yi, J., Huang, S.-J., & Chen, S. (2021) · arXiv (Cornell University) · Cited by 6 · see citing works
Bridging the Gap Between Adversarial Robustness and Optimization BiasPreprint
Faghri, F., Gowal, S., Vasconcelos, C. N., Fleet, D. J., Pedregosa, F., & Roux, N. L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.08868 · Cited by 4 · see citing works
RoBIC: A Benchmark Suite For Assessing Classifiers Robustness
Maho, T., Bonnet, B., Furon, T., & Merrer, E. L. (2021) · Proceedings - International Conference on Image Processing · doi:10.1109/icip42928.2021.9506053 · Cited by 4 · see citing works
ClusTR: Clustering Training for Robustness.Preprint
Alfarra, M., Pérez, J. C., Bibi, A., Thabet, A., Arbeláez, P., & Ghanem, B. (2020) · arXiv (Cornell University) · Cited by 2 · see citing works
Incorporating Label Uncertainty in Understanding Adversarial Robustness.Preprint
Zhang, X. L., & Evans, D. (2021) · arXiv (Cornell University) · Cited by 1 · see citing works
Flagged first, then by citations
7 of the 135 references couldn’t be matched to a known paper.
Research works printed but not linked: 47
- [3][3] M. Andriushchenko and N. Flammarion. Understanding and improving fast adversarial training. NeurIPS , 2020. -
- [4][4] M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein. Square attack: a query-efficient black-box adversarial attack via random search. In ECCV , 2020. -
- [6][6] M. Atzmon, N. Haim, L. Yariv, O. Israelov, H. Maron, and Y. Lipman. Controlling neural level sets. NeurIPS , 2019. -
- [14][14] D. A. Calian, F. Stimberg, O. Wiles, S.-A. Rebuffi, A. Gyorgy, T. Mann, and S. Gowal. Defending against image corruptions through adversarial augmentations. arXiv , 2021. -
- [16][16] N. Carlini. A complete list of all (arxiv) adversarial example papers. https://nicholas.carlini. com/writing/2019/all-adversarial-example-papers.html , 2021. Accessed: 2021-06-08. -
- [21][21] J. Chen and Q. Gu. Rays: A ray searching method for hard-label adversarial attack. In KDD , 2020. -
- [23][23] T. Chen, S. Liu, S. Chang, Y. Cheng, L. Amini, and Z. Wang. Adversarial robustness: From self-supervised pre-training to fine-tuning. In CVPR , 2020. -
- [29][29] F. Croce, M. Andriushchenko, N. D. Singh, N. Flammarion, and M. Hein. Sparse-rs: a versatile framework for query-efficient sparse black-box adversarial attacks. In ECCV Workshop on Adversarial Robustness in the Real World , 2020. -
- [35][35] Y. Dong, Q.-A. Fu, X. Yang, T. Pang, H. Su, Z. Xiao, and J. Zhu. Benchmarking adversarial robustness on image classification. In CVPR , 2020. -
- [38][38] L. Engstrom, A. Ilyas, S. Santurkar, D. Tsipras, B. Tran, and A. Madry. Adversarial robustness as a prior for learned representations. arXiv preprint arXiv:1906.00945 , 2019. - · arXiv
- [39][39] L. Engstrom, B. Tran, D. Tsipras, L. Schmidt, and A. Madry. Exploring the landscape of spatial robustness. In ICML , 2019. -
- [42][42] A. Fawzi and P. Frossard. Manitest: Are classifiers really invariant? In BMVC , 2015. -
- [46][46] I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In ICLR , 2015. -
- [48][48] S. Gowal, K. D. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. Mann, and P. Kohli. Scalable verified training for provably robust image classification. In ICCV , 2019. -
- [51][51] K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel. Adversarial examples for malware detection. In European symposium on research in computer security , 2017. -
- [53][53] C. Guo, M. Rana, M. Cisse, and L. van der Maaten. Countering adversarial images using input transformations. In ICLR , 2018. -
- [54][54] C. Guo, J. R. Gardner, Y. You, A. G. Wilson, and K. Q. Weinberger. Simple black-box adversarial attacks. In ICML , 2019. -
- [56][56] M. Hein and M. Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In NeurIPS , 2017. -
- [57][57] M. Hein, M. Andriushchenko, and J. Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In CVPR , 2019. -
- [63][63] J. E. Hu, A. Swaminathan, H. Salman, and G. Yang. Improved image wasserstein attacks and defenses. ICLR Workshop: Towards Trustworthy ML: Rethinking Security and Privacy for ML , 2020. -
- [66][66] C. Jin and M. Rinard. Manifold regularization for adversarial robustness. arXiv , 2020. -
- [67][67] A. Ju. Generative models as a robust alternative for image classification: Progress and challenges. PhD thesis, UC Berkeley , 2021. -
- [76][76] B. Kulynych, R. Overdorf, C. Troncoso, and S. Gürses. Pots: protective optimization technologies. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency , pages 177-188, 2020. -
- [82][82] M. Lecuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE S&P , 2019. -
- [83][83] L. Li, M. Weber, X. Xu, L. Rimanic, B. Kailkhura, T. Xie, C. Zhang, and B. Li. Tss: Transformationspecific smoothing for robustness certification. In ACM CCS , 2021. -
- [84][84] Y. Li, J. Bradshaw, and Y. Sharma. Are generative classifiers more robust to adversarial attacks? In ICML , 2019. -
- [88][88] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR , 2018. -
- [98][98] M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig, I. Molloy, and B. Edwards. Adversarial robustness toolbox v1.2.0. arXiv preprint arXiv:1807.01069 , 2018. - · arXiv
- [109][109] M. S. Rahman, M. Imani, N. Mathews, and M. Wright. Mockingbird: Defending against deep-learningbased website fingerprinting attacks with adversarial traces. IEEE Transactions on Information Forensics and Security , 16:1594-1609, 2020. -
- [112][112] B. Recht, R. Roelofs, L. Schmidt, and V. Shankar. Do imagenet classifiers generalize to imagenet? In ICML , 2019. -
- [113][113] L. Rice, E. Wong, and J. Z. Kolter. Overfitting in adversarially robust deep learning. In ICML , 2020. -
- [117][117] H. Salman, A. Ilyas, L. Engstrom, A. Kapoor, and A. Madry. Do adversarially robust imagenet models transfer better? NeurIPS , 2020. -
- [121][121] V. Sehwag, S. Wang, P. Mittal, and S. Jana. Hydra: Pruning adversarially robust neural networks. NeurIPS , 2020. -
- [122][122] V. Sehwag, S. Wang, P. Mittal, and S. Jana. On pruning adversarially robust neural networks. NeurIPS , 2020. -
- [124][124] A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein. Adversarial training for free! NeurIPS , 2019. -
- [126][126] C. Shi, C. Holtz, and G. Mishne. Online adversarial purification based on self-supervised learning. In International Conference on Learning Representations , 2021. URL https://openreview.net/ forum?id=\_i3ASPp12WS . -
- [133][133] K. Sridhar, O. Sokolsky, I. Lee, and J. Weimer. Robust learning via persistency of excitation. arXiv , 2021. -
- [134][134] D. Stutz, M. Hein, and B. Schiele. Relating adversarially robust generalization to flat minima. In ICCV , 2021. -
- [139][139] G. Tolias, F. Radenovic, and O. Chum. Targeted mismatch adversarial attack: Query with a flower to retrieve the tower. In ICCV , 2019. -
- [141][141] F. Tramèr, P. Dupré, G. Rusak, G. Pellegrino, and D. Boneh. Adversarial: Perceptual ad blocking meets adversarial machine learning. In ACM SIGSAC CCS , 2019. -
- [144][144] J. Uesato, J.-B. Alayrac, P.-S. Huang, R. Stanforth, A. Fawzi, and P. Kohli. Are labels required for improving adversarial robustness? NeurIPS , 2019. -
- [148][148] Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu. Improving adversarial robustness requires revisiting misclassified examples. ICLR , 2020. -
- [149][149] T.-W. Weng, H. Zhang, H. Chen, Z. Song, C.-J. Hsieh, D. Boning, I. S. Dhillon, and L. Daniel. Towards fast computation of certified robustness for relu networks. In ICML , 2018. -
- [154][154] B. Wu, J. Chen, D. Cai, X. He, and Q. Gu. Do wider neural networks really help adversarial robustness? arXiv , 2020. -
- [162][162] Y.-Y. Yang, C. Rashtchian, H. Zhang, R. Salakhutdinov, and K. Chaudhuri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems , 33, 2020. -
- [165][165] D. Zhang, T. Zhang, Y. Lu, Z. Zhu, and B. Dong. You only propagate once: Accelerating adversarial training via maximal principle. NeurIPS , 2019. -
- [169][169] H. Zhang, H. Chen, C. Xiao, S. Gowal, R. Stanforth, B. Li, D. Boning, and C.-J. Hsieh. Towards stable and efficient training of verifiably robust neural networks. ICLR , 2020. -
Cited by
Sorted by citations
Interpretable deep learning: interpretation, interpretability, trustworthiness, and beyond
Li, X., Xiong, H., Li, X., Wu, X., Zhang, X., Liu, J., Bian, J., & Dou, D. (2022) · Knowledge and Information Systems · doi:10.1007/s10115-022-01756-8 · Cited by 542 · see citing works
Continual Test-Time Domain Adaptation
Wang, Q., Fink, O., Gool, L. V., & Dai, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.00706 · Cited by 536 · see citing works
WILDS: A Benchmark of in-the-Wild Distribution Shifts
Koh, P. W., Sagawa, S., Marklund, H., Xie, S. M., Zhang, M., Balsubramani, A., Hu, W., Yasunaga, M., Phillips, R. L., Gao, I., et al. (2020) · arXiv · doi:10.48550/arxiv.2012.07421 · Cited by 518 · see citing works
“Benchmarks for adversarial robustness also fall in this category of distribution shifts from transformations (Goodfellow et al., 2015; Croce et al., 2020).”
Trustworthy ai: A computational perspective
Liu, H., Wang, Y., Fan, W., Liu, X., Li, Y., Jain, S., Liu, Y., Jain, A., & Tang, J. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3546872 · Cited by 261 · see citing works
Adversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 194 · see citing works
An artificial intelligence life cycle: from conception to production
De Silva, D., & Alahakoon, D. (2022) · Patterns · doi:10.1016/j.patter.2022.100489 · Cited by 189 · see citing works
How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
Costa, J. C., Roxo, T., Proença, H. P. M. C., & Inácio, P. R. M. (2024) · IEEE Access · doi:10.1109/access.2024.3395118 · Cited by 168 · see citing works
Fixing Data Augmentation to Improve Adversarial RobustnessPreprint
Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., & Mann, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.01946 · Cited by 153 · see citing works
SoK: Certified Robustness for Deep Neural Networks
Li, L., Xie, T., & Li, B. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179303 · Cited by 143 · see citing works
Robust Test-Time Adaptation in Dynamic Scenarios
Yuan, L., Xie, B., & Li, S. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01528 · Cited by 132 · see citing works
Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks
Croce, F., Andriushchenko, M., Singh, N. D., Flammarion, N., & Hein, M. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i6.20595 · Cited by 118 · see citing works
Self-citationA Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking
Liu, C., Dong, Y., Xiang, W., Yang, X. H., Su, H., Zhu, J., Chen, Y., He, Y., Xue, H., & Zheng, S. (2024) · International Journal of Computer Vision · doi:10.1007/s11263-024-02196-3 · Cited by 117 · see citing works
Improving Robustness using Generated DataPreprint
Gowal, S., Rebuffi, S.-A., Wiles, O., Stimberg, F., Calian, D. A., & Mann, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.09468 · Cited by 114 · see citing works
Vassilev, A. (2025) · doi:10.6028/nist.ai.100-2e2025 · Cited by 106 · see citing works
Robust Mean Teacher for Continual and Gradual Test-Time Adaptation
Döbler, M., Marsden, R. A., & Yang, B. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00744 · Cited by 99 · see citing works
Unsolved Problems in ML Safety
Hendrycks, D., Carlini, N., Schulman, J., & Steinhardt, J. (2021) · arXiv · doi:10.48550/arxiv.2109.13916 · Cited by 95 · see citing works
3D Common Corruptions and Data Augmentation
Kar, O. F., Yeo, T., Atanov, A., & Zamir, A. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01839 · Cited by 90 · see citing works
Decorate the Newcomers: Visual Domain Prompt for Continual Test Time Adaptation
Gan, Y., Bai, Y., Lou, Y., Ma, X., Zhang, R., Shi, N., & Luo, L. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i6.25922 · Cited by 86 · see citing works
A comprehensive evaluation framework for deep model robustness
Guo, J., Bao, W., Wang, J., Ma, Y., Gao, X., Xiao, G., Liu, A., Dong, J., Liu, X., & Wu, W. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109308 · Cited by 79 · see citing works
EcoTTA: Memory-Efficient Continual Test-Time Adaptation via Self-Distilled Regularization
Song, J., Lee, J., Kweon, I. S., & Choi, S. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01147 · Cited by 72 · see citing works
RobustART: Benchmarking Robustness on Architecture Design and Training TechniquesPreprint
Tang, S., Gong, R., Wang, Y., Liu, A., Wang, J., Chen, X., Yu, F., Liu, X., Song, D., Yuille, A., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.05211 · Cited by 71 · see citing works
Exploring misclassifications of robust neural networks to enhance adversarial attacks
Schwinn, L., Raab, R., Nguyen, A., Zanca, D., & Eskofier, B. M. (2023) · Applied Intelligence · doi:10.1007/s10489-023-04532-5 · Cited by 70 · see citing works
Li, T., Wu, Y., Chen, S., Fang, K., & Huang, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01305 · Cited by 69 · see citing works
AdvDiffuser: Natural Adversarial Example Synthesis with Diffusion Models
Chen, X., Gao, X., Zhao, J., Ye, K., & Xu, C. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00421 · Cited by 68 · see citing works
Adversarial purification with Score-based generative modelsPreprint
Yoon, J., Hwang, S. J., & Lee, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.06041 · Cited by 65 · see citing works
Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?Preprint
Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., & Mittal, P. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.09425 · Cited by 60 · see citing works
Self-citationModel metamers reveal divergent invariances between biological and artificial neural networks
Feather, J., Leclerc, G., Mądry, A., & McDermott, J. H. (2023) · Nature Neuroscience · doi:10.1038/s41593-023-01442-0 · Cited by 59 · see citing works
Boosting Accuracy and Robustness of Student Models via Adaptive Adversarial Distillation
Huang, B., Chen, M., Wang, Y., Lu, J., Cheng, M., & Wang, W. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02363 · Cited by 58 · see citing works
Robust Evaluation of Diffusion-Based Adversarial Purification
Lee, M., & Kim, D. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00019 · Cited by 58 · see citing works
Choi, S., Yang, S., Choi, S., & Yun, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19827-4_26 · Cited by 56 · see citing works
On the effectiveness of adversarial training against common corruptionsPreprint
Kireev, K., Andriushchenko, M., & Flammarion, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.02325 · Cited by 54 · see citing works
Self-citationTaxonomy of Machine Learning Safety: A Survey and Primer
Mohseni, S., Wang, H., Xiao, C., Yu, Z., Wang, Z., & Yadawa, J. (2023) · ACM Computing Surveys · doi:10.1145/3551385 · Cited by 53 · see citing works
ImageNet-Patch: A dataset for benchmarking machine learning robustness against adversarial patches
Pintor, M., Angioni, D., Sotgiu, A., Demetrio, L., Demontis, A., Biggio, B., & Roli, F. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.109064 · Cited by 48 · see citing works
Defense Against Adversarial Attacks Using Topology Aligning Adversarial Training
Kuang, H., Liu, H., Lin, X., & Ji, R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3359820 · Cited by 46 · see citing works
The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Training
Dong, J., Moosavi-Dezfooli, S.-M., Lai, J., & Xie, X. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02364 · Cited by 44 · see citing works
Fast Minimum-norm Adversarial Attacks through Adaptive Norm ConstraintsPreprint
Pintor, M., Roli, F., Brendel, W., & Biggio, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.12827 · Cited by 44 · see citing works
Test-time Batch Statistics Calibration for Covariate ShiftPreprint
You, F., Li, J., & Zhao, Z. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.04065 · Cited by 43 · see citing works
Attack and Defense: Adversarial Security of Data-Driven FDC Systems
Zhuo, Y., Yin, Z., & Ge, Z. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3197190 · Cited by 42 · see citing works
Hsiung, L., Tsai, Y.-Y., Chen, P., & Ho, T.-Y. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02362 · Cited by 41 · see citing works
A Probabilistic Framework for Lifelong Test-Time Adaptation
Brahma, D., & Rai, P. (2022) · Computer Vision and Pattern Recognition · doi:10.1109/cvpr52729.2023.00349 · Cited by 85 · see citing works
In Search of Lost Online Test-Time Adaptation: A Survey
Wang, Z., Luo, Y., Zheng, L., Chen, Z., Wang, S., & Huang, Z. H. (2024) · International Journal of Computer Vision · doi:10.1007/s11263-024-02213-5 · Cited by 40 · see citing works
One Prompt Word is Enough to Boost Adversarial Robustness for Pre-Trained Vision-Language Models
Li, L., Guan, H., Qiu, J., & Spratling, M. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02304 · Cited by 39 · see citing works
Black-Box Sparse Adversarial Attack via Multi-Objective Optimisation CVPR Proceedings
Williams, P. N., & Li, K. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01183 · Cited by 37 · see citing works
A Light Recipe to Train Robust Vision Transformers
Debenedetti, E., Sehwag, V., & Mittal, P. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00024 · Cited by 36 · see citing works
Self-citationRobust Mixture-of-Expert Training for Convolutional Neural Networks
Zhang, Y., Cai, R., Chen, T., Zhang, G., Zhang, H., Chen, P., Chang, S., Wang, Z., & Liu, S. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00015 · Cited by 35 · see citing works
BIAS: A Toolbox for Benchmarking Structural Bias in the Continuous Domain
Vermetten, D., van Stein, B., Caraffini, F., Minku, L. L., & Kononova, A. V. (2022) · IEEE Transactions on Evolutionary Computation · doi:10.1109/tevc.2022.3189848 · Cited by 35 · see citing works
Three Challenges to Secure AI Systems in the Context of AI Regulations
Hamon, R., Junklewitz, H., Garrido, J. S., & Sánchez, I. (2024) · IEEE Access · doi:10.1109/access.2024.3391021 · Cited by 34 · see citing works
Augmented Lagrangian Adversarial Attacks
Rony, J., Granger, É., Pedersoli, M., & Ayed, I. B. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00764 · Cited by 34 · see citing works
Relating Adversarially Robust Generalization to Flat Minima
Stutz, D., Hein, M., & Schiele, B. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00771 · Cited by 32 · see citing works
Self-citationBlackboxBench: A Comprehensive Benchmark of Black-Box Adversarial Attacks
Zheng, M., Yan, X., Zhu, Z., Chen, H., & Wu, B. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3574432 · Cited by 31 · see citing works
Adversarial Robustness Via Fisher-Rao Regularization
Picot, M., Messina, F. J., Boudiaf, M., Labeau, F., Ayed, I. B., & Piantanida, P. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3174724 · Cited by 31 · see citing works
Continual Test-time Domain Adaptation via Dynamic Sample Selection
Wang, Y., Hong, J., Cheraghian, A., Rahman, S., Ahmedt‐Aristizabal, D., Petersson, L., & Harandi, M. T. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00172 · Cited by 30 · see citing works
Data filtering for efficient adversarial training
Chen, E., & Lee, C. (2024) · Pattern Recognition · doi:10.1016/j.patcog.2024.110394 · Cited by 29 · see citing works
CNN Filter DB: An Empirical Investigation of Trained Convolutional Filters
Gavrikov, P., & Keuper, J. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01848 · Cited by 29 · see citing works
TIPI: Test Time Adaptation with Transformation Invariance
Nguyen, A. T., Nguyen-Tang, T., Lim, S.-N., & Torr, P. H. S. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02314 · Cited by 29 · see citing works
Mitigating Accuracy-Robustness Trade-Off via Balanced Multi-Teacher Adversarial Distillation
Zhao, S., Wang, X., & Wei, X. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3416308 · Cited by 28 · see citing works
Assaying Out-Of-Distribution Generalization in Transfer Learning
Wenzel, F., Dittadi, A., Gehler, P., Simon-Gabriel, C.-J., Horn, M., Zietlow, D., Kernert, D., Russell, C., Brox, T., Schiele, B., et al. (2022) · neural information processing systems · doi:10.52202/068431-0521 · Cited by 28 · see citing works
Parameterizing Activation Functions for Adversarial Robustness
Dai, S., Mahloujifar, S., & Mittal, P. (2022) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw54247.2022.9833884 · Cited by 27 · see citing works
Self-citationSparse Visual Counterfactual Explanations in Image Space
Boreiko, V., Augustin, M., Croce, F., Berens, P., & Hein, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-16788-1_9 · Cited by 27 · see citing works
Self-citationAcharya, K., & Song, H. (2025) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-025-10887-3 · Cited by 26 · see citing works
TSS: Transformation-Specific Smoothing for Robustness Certification
Li, L., Weber, M., Xu, X., Rimanić, L., Kailkhura, B., Xie, T., Zhang, C., & Li, B. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485258 · Cited by 26 · see citing works
REAP: A Large-Scale Realistic Adversarial Patch Benchmark
Hingun, N., Sitawarin, C., Li, J. Z., & Wagner, D. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00428 · Cited by 25 · see citing works
A qualitative AI security risk assessment of autonomous vehicles
Grosse, K., & Alahi, A. (2024) · Transportation Research Part C Emerging Technologies · doi:10.1016/j.trc.2024.104797 · Cited by 24 · see citing works
Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine LearningPreprint
Zheng, Q., Zou, X., Dong, Y., Cen, Y., Yin, D., Xu, J., Yang, Y., & Tang, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.04314 · Cited by 24 · see citing works
Towards Real-World Test-Time Adaptation: Tri-net Self-Training with Balanced Normalization
Su, Y., Xu, X., & Jia, K. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i13.29435 · Cited by 23 · see citing works
Yang, Y., Gao, R., Li, Y., Lai, Q., & Xu, Q. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24001 · Cited by 23 · see citing works
Defending Against Image Corruptions Through Adversarial AugmentationsPreprint
Calian, D. A., Stimberg, F., Wiles, O., Rebuffi, S.-A., György, A., Mann, T., & Gowal, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.01086 · Cited by 23 · see citing works
Privacy Leakage of Adversarial Training Models in Federated Learning Systems
Zhang, J., Chen, Y., & Li, H. H. (2022) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw56347.2022.00021 · Cited by 22 · see citing works
Neuro-Modulated Hebbian Learning for Fully Test-Time Adaptation
Tang, Y., Zhang, C., Xu, H., Chen, S., Cheng, J., Leng, L., Guo, Q., & He, Z. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00363 · Cited by 22 · see citing works
MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model
Song, K., Lai, H., Pan, Y., & Yin, J. J. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02329 · Cited by 21 · see citing works
Specification overfitting in artificial intelligence
Roth, B., de Araujo, P. H. L., Xia, Y., Kaltenbrunner, S., & Korab, C. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-11040-6 · Cited by 21 · see citing works
Attacking Adversarial Attacks as A DefensePreprint
Wú, B., Pan, H., Shen, L., Gu, J., Zhao, S., Li, Z., Cai, D., He, X., & Liu, W. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.04938 · Cited by 21 · see citing works
If a human can see it, so should your system
Hu, B. C., Marsso, L., Czarnecki, K., Salay, R., Shen, H., & Chećhik, M. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510109 · Cited by 20 · see citing works
Analyzing and Improving Resilience and Robustness of Autonomous Systems
Wan, Z., Swaminathan, K., Chen, P., Chandramoorthy, N., & Raychowdhury, A. (2022) · International Conference on Computer Aided Design · doi:10.1145/3508352.3561111 · Cited by 19 · see citing works
Towards Backdoor Attacks and Defense in Robust Machine Learning Models
Soremekun, E., Udeshi, S., & Chattopadhyay, S. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103101 · Cited by 19 · see citing works
RobustMQ: benchmarking robustness of quantized models
Xiao, Y., Liu, A., Zhang, T., Qin, H., Guo, J., & Liu, X. (2023) · Visual Intelligence · doi:10.1007/s44267-023-00031-w · Cited by 19 · see citing works
Robust Distillation via Untargeted and Targeted Intermediate Adversarial Samples
Dong, J., Koniusz, P., Chen, J., Wang, Z. J., & Ong, Y.-S. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02686 · Cited by 19 · see citing works
Imbalanced gradients: a subtle cause of overestimated adversarial robustness
Ma, X., Jiang, L., Huang, H., Weng, Z., Bailey, J., & Jiang, Y. (2023) · Machine Learning · doi:10.1007/s10994-023-06328-7 · Cited by 19 · see citing works
Adversarial Attacks and Defenses in Image Classification: A Practical Perspective
Chen, Y., Zhang, M., Li, J., & Kuang, X. (2022) · International Conference on Image, Vision and Computing (ICIVC) · doi:10.1109/icivc55077.2022.9886997 · Cited by 18 · see citing works
Scaling Adversarial Training to Large Perturbation Bounds
Addepalli, S., Jain, S., Sriramanan, G., & Babu, R. V. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20065-6_18 · Cited by 18 · see citing works
FrequencyLowCut Pooling - Plug and Play Against Catastrophic Overfitting
Grabinski, J., Jung, S., Keuper, J., & Keuper, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19781-9_3 · Cited by 18 · see citing works
Rethinking data augmentation for adversarial robustness
Eghbal-zadeh, H., Zellinger, W., Pintor, M., Grosse, K., Koutini, K., Moser, B., Biggio, B., & Widmer, G. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119838 · Cited by 18 · see citing works
TEA: Test-Time Energy Adaptation
Yuan, Y., Xu, B., Hou, L., Sun, F., Shen, H., & Cheng, X. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02256 · Cited by 18 · see citing works
Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples
Pintor, M., Demetrio, L., Sotgiu, A., Demontis, A., Carlini, N., Biggio, B., & Roli, F. (2022) · neural information processing systems · doi:10.52202/068431-1676 · Cited by 18 · see citing works
Test time Adaptation through Perturbation RobustnessPreprint
Sivaprasad, P. T., & Fleuret, F. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.10232 · Cited by 18 · see citing works
Robustness-Congruent Adversarial Training for Secure Machine Learning Model Updates
Angioni, D., Demetrio, L., Pintor, M., Oneto, L., Anguita, D., Biggio, B., & Roli, F. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3573237 · Cited by 17 · see citing works
Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart
Pang, T., Zhang, H., He, D., Dong, Y., Su, H., Chen, W. R., Zhu, J., & Liu, T. Y. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01479 · Cited by 17 · see citing works
Improving Adversarial Robustness Using Proxy Distributions.Preprint
Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., & Mittal, P. (2021) · arXiv (Cornell University) · Cited by 17 · see citing works
Self-citationA Winning Hand: Compressing Deep Networks Can Improve Out-Of-Distribution RobustnessPreprint
Diffenderfer, J., Bartoldson, B. R., Chaganti, S., Zhang, J., & Kailkhura, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09129 · Cited by 17 · see citing works
Okuno, M. J., & Okuno, H. G. (2025) · AI & Society · doi:10.1007/s00146-025-02288-9 · Cited by 16 · see citing works
Aliasing and adversarial robust generalization of CNNs
Grabinski, J., Keuper, J., & Keuper, M. (2022) · Machine Learning · doi:10.1007/s10994-022-06222-8 · Cited by 16 · see citing works
Fighting Gradients with Gradients: Dynamic Defenses against Adversarial AttacksPreprint
Wang, D., Ju, A., Shelhamer, E., Wagner, D., & Darrell, T. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.08714 · Cited by 16 · see citing works
Gittens, A., Yener, B., & Yung, M. M. (2022) · IEEE Access · doi:10.1109/access.2022.3218715 · Cited by 15 · see citing works
Improving Robust Fariness via Balance Adversarial Training
Sun, C., Xu, C., Yao, C., Liang, S., Wu, Y., Ding, L., Liu, X., & Liu, A. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i12.26769 · Cited by 15 · see citing works
Revisiting the Trade-Off Between Accuracy and Robustness via Weight Distribution of Filters
Wei, X., Zhao, S., & Li, B. H. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3411035 · Cited by 15 · see citing works
Language Translation as a Socio-Technical System:Case-Studies of Mixed-Initiative Interactions
Santy, S., Bali, K., Choudhury, M., Dandapat, S., Ganu, T., Shukla, A., Shah, J., & Seshadri, V. (2021) · ACM SIGCAS Conference on Computing and Sustainable Societies (COMPASS) · doi:10.1145/3460112.3471954 · Cited by 15 · see citing works
Adversarial guided diffusion models for adversarial purification
Lin, G., Tao, Z., Zhang, J., Tanaka, T., & Zhao, Q. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107705 · Cited by 14 · see citing works
Accelerate adversarial training with loss guided propagation for robust image classification
Xu, C., Zhang, C., Yang, Y., Yang, H., Bo, Y., Li, D., & Zhang, R. (2022) · Information Processing & Management · doi:10.1016/j.ipm.2022.103143 · Cited by 14 · see citing works
Lapid, R., Haramaty, Z., & Sipper, M. (2022) · Algorithms · doi:10.3390/a15110407 · Cited by 14 · see citing works
AROID: Improving Adversarial Robustness Through Online Instance-Wise Data Augmentation
Li, L., Qiu, J., & Spratling, M. (2024) · International Journal of Computer Vision · doi:10.1007/s11263-024-02206-4 · Cited by 14 · see citing works
- Authors
- Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., & Hein, M.
- Affiliations
- University of Tübingen (DE)
- École Polytechnique Fédérale de Lausanne (CH)
- Princeton University (US)
- Purdue University West Lafayette (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2010.09670
- OpenAlex
- W3093235747
- Cited by
- 284
- References
- 135
- Citations by year
- 2025: 41 · 2024: 86 · 2023: 62 · 2022: 48 · 2021: 46 · 2020: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (acceptedVersion)
- arXiv (Cornell University) (submittedVersion)
- Infoscience (Ecole Polytechnique Fédérale de Lausanne) (submittedVersion, cc-by-nc-nd)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1553437, 1704105)
- Deutsche Forschungsgemeinschaft (206/4-1, EXC2064, TRR 248, EXC 2064_1, 390727645, 389792660)
- Bundesministerium für Bildung und Forschung (01IS18039A)
- Office of Naval Research
- Army Research Office
- Army Research Laboratory
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Machine Learning and Data Classification
- Keywords
- adversarial robustness, benchmarking, image classification, AutoAttack, adaptive attacks, corruption, distribution shift, calibration, out-of-distribution detection, fairness, privacy leakage, transferability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
