Recent Advances in Adversarial Training for Adversarial Robustness

Bai, Tao; Luo, Jinqi; Zhao, Jun; Wen, Bihan; Wang, Qian

doi:10.48550/arxiv.2102.01356

PreprintCited by 642Adversarial Robustness in Machine LearningSecurity and Verification in ComputingDigital Media Forensic Detection

Recent Advances in Adversarial Training for Adversarial Robustness

Open access

Bai, Tao, Luo, Jinqi, Zhao, Jun, Wen, Bihan, Wang, Qian·2021·arXiv

DOI 10.48550/arxiv.2102.01356arXiv 2102.01356

Open this paper in CoChat — free account Open PDF

Abstract

Adversarial training is one of the most effective approaches defending against adversarial examples for deep learning models. Unlike other defense strategies, adversarial training aims to promote the robustness of models intrinsically. During the last few years, adversarial training has been studied and discussed from various aspects. A variety of improvements and developments of adversarial training are proposed, which were, however, neglected in existing surveys. For the first time in this survey, we systematically review the recent progress on adversarial training for adversarial robustness with a novel taxonomy. Then we discuss the generalization problems in adversarial training from three perspectives. Finally, we highlight the challenges which are not fully tackled and present potential future directions.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2102.01356

Cites

101 of 101 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Adversarial training is widely adopted to improve model robustness against adversarial attacks by incorporating adversarial examples into the training process.
“Adversarial training [201] is widely adopted to improve model robustness against adversarial attacks by incorporating adversarial examples into the training process.”
From Deepfake detection across image, video, and audio: a comprehensive survey with empirical evaluation of generalization and robustness (2026) · cites this paper as [201]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

I and J
Marsden, W. (2012) · doi:10.1017/cbo9781139207249.009 · Cited by 170,911 · cited 5×
“Su et al. (2018) evaluated the recent SOTA ImageNet-based DNN models on multiple robustness metrics.”
MethodResultInfluential
arXiv
Rosenbloom, L. (2019) · Charleston Advisor · doi:10.5260/chara.21.2.8 · Cited by 16,663 · cited 4× · see citing works
“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al.”
MethodResultInfluential
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · cited 15× · see citing works
“The adversarial counterpart x ′ of x is expressed as There are some common attacks following this formulation like Fast Gradient Sign Method (FGSM) [Goodfellow et al. , 2015], iterative FGSM [Kurakin et al. , 2016], and Projected Gradient Descent (PGD) attack [Madry et al. , 2018].”
BackgroundMethodInfluential
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · cited 12× · see citing works
“Current adversarial training methods [Madry et al. , 2018] can produce a robust model with worst-case accuracy of around 90% on MNIST.”
BackgroundMethodInfluential
mixup: Beyond Empirical Risk Minimization
Zhang, H., Cisse, M., Dauphin, Y. N., & Lopez-Paz, D. (2017) · arXiv · doi:10.48550/arxiv.1710.09412 · Cited by 5,831 · cited 1× · see citing works
“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al., 2018] and early stopping, where early stopping is found to be the most effective.”
Method
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · cited 2× · see citing works
“, 2015], iterative FGSM [Kurakin et al., 2016], and Projected Gradient Descent (PGD) attack [Madry et al.”
BackgroundMethod
Practical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works
Improved regularization of convolutional neural networks with cutout
DeVries, T., & Taylor, G. W. (2017) · arXiv · doi:10.48550/arxiv.1708.04552 · Cited by 2,776 · cited 1× · see citing works
“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al.”
Method
Adversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325 · cited 1× · see citing works
“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”
Background
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176 · see citing works
Recognizing linked events: Searching the space of feasible explanations
Damen, D., & Hogg, D. C. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206636 · Cited by 2,111 · cited 4× · see citing works
“The shreds of evidence in [Yang et al., 2020b; Stutz et al., 2019] show that adversarial training might not be the optimal solution for obtaining models with desirable robustness and accuracy.”
BackgroundInfluential
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
Akhtar, N., & Mian, A. (2018) · IEEE Access · doi:10.1109/access.2018.2807385 · Cited by 2,021 · cited 1× · see citing works
“To our best knowledge, surveys focusing on adversarial training do not exist, as recently proposed surveys [Akhtar and Mian, 2018; Wiyatno et al., 2019] aim at summarizing existing adversarial attacks and defense methods.”
Background
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733 · cited 2× · see citing works
“Toour best knowledge, surveys focusing on adversarial training do not exist so far, and recently proposed surveys [Yuan et al. , 2019; Silva and Najaﬁrad, 2020] mainly summarize existing adversarial attacks and defense methods.”
BackgroundMethod
Theoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019) · arXiv · doi:10.48550/arxiv.1901.08573 · Cited by 1,560 · see citing works
Adversarial Training for Free!
Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J. P., Studer, C., Davis, L., Taylor, G., & Goldstein, T. (2019) · Neural Information Processing Systems · doi:10.48550/arxiv.1904.12843 · Cited by 1,514 · cited 3×
“One well-known limitation of conventional adversarial training methods like PGD-AT is that they take 3-30 times longer than standard training before the model converges [Shafahi et al. , 2019].”
BackgroundMethod
Fast is better than free: Revisiting adversarial trainingPreprint
Wong, E., Rice, L., & Kolter, J. (2020) · International Conference on Learning Representations · doi:10.48550/arxiv.2001.03994 · Cited by 1,444 · see citing works
Robustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,240 · cited 1× · see citing works
“Tsipras et al. (2018) claimed that standard accuracy and adversarial robustness might at odds and demonstrated the existence of the trade-off via a binary classiﬁcation task.”
Background
Countering Adversarial Images using Input TransformationsPreprint
Guo, C., Rana, M., Cissé, M., & van der Maaten, L. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.00117 · Cited by 1,151 · see citing works
Adversarial classification
Dalvi, N. N., Domingos, P. M., Mausam, Sanghai, S. K., & Verma, D. (2004) · Knowledge Discovery and Data Mining · doi:10.1145/1014052.1014066 · Cited by 1,085 · cited 1× · see citing works
“The initial idea of adversarial training is firstly brought to light by [Dalvi et al., 2004; Lowd and Meek, 2005] in a game-theoretic setup.”
Background
Audio Adversarial Examples: Targeted Attacks on Speech-to-Text
Carlini, N., & Wagner, D. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00009 · Cited by 1,071 · see citing works
Adversarial Examples Are Not Bugs, They Are Features
Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., & Madry, A. (2019) · arXiv · doi:10.48550/arxiv.1905.02175 · Cited by 971 · cited 1× · see citing works
“…and Qureshi, 2019] (input gradients refer to the gradients of the loss function w.r.t. the input); and maximizing the vulnerability diversity [Yang et al. , 2020a], which is deﬁned as the sum of losses for two models with crafted images containing non-robust features [Ilyas et al. , 2019].”
Background
Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser
Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., & Zhu, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00191 · Cited by 967 · see citing works
Adversarial Examples for Semantic Segmentation and Object Detection
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.153 · Cited by 955 · see citing works
Adversarial Attack on Graph Structured DataPreprint
Dai, H.-J., Li, H., Tian, T., Huang, X., Wang, L., Zhu, J., & Song, L. (2018) · International Conference on Machine Learning · doi:10.48550/arxiv.1806.02371 · Cited by 926 · see citing works
Generating Natural Language Adversarial Examples
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M. B., & Chang, K.-W. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1316 · Cited by 895 · see citing works
Adversarially Robust Generalization Requires More DataPreprint
Schmidt, L., Santurkar, S., Tsipras, D., Talwar, K., & Ma̧dry, A. (2018) · Neural Information Processing Systems · doi:10.48550/arxiv.1804.11285 · Cited by 891 · see citing works
Identifying and attacking the saddle point problem in high-dimensional non-convex optimization
Dauphin, Y., Pascanu, R., Gulcehre, C., Cho, K., Ganguli, S., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1406.2572 · Cited by 827 · see citing works
Adversarial learning
Lowd, D., & Meek, C. (2005) · Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining · doi:10.1145/1081870.1081950 · Cited by 755 · cited 1× · see citing works
“The initial idea of adversarial training is firstly brought to light by [Dalvi et al., 2004; Lowd and Meek, 2005] in a game-theoretic setup.”
Background
Adversarial Attacks on Neural Network PoliciesPreprint
Huang, S., Papernot, N., Goodfellow, I., Duan, Y., & Abbeel, P. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.02284 · Cited by 694 · see citing works
Adversarial Logit Pairing
Kannan, H., Kurakin, A., & Goodfellow, I. (2018) · Neural Information Processing Systems · doi:10.48550/arxiv.1803.06373 · Cited by 673 · cited 2×
“[Kannan et al., 2018] proposed Adversarial Logit Pairing (ALP), a regularization method taking effects on logits.”
BackgroundMethod
The Space of Transferable Adversarial ExamplesPreprint
Tramèr, F., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv.org · doi:10.48550/arxiv.1704.03453 · Cited by 649 · cited 1× · see citing works
“, 2014] and share the adversarial subspace [Tramèr et al., 2017], which potentially hurts the”
Background
Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty
Hendrycks, D., Mazeika, M., Kadavath, S., & Song, D. (2019) · arXiv · doi:10.48550/arxiv.1906.12340 · Cited by 634 · see citing works
Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients
Ross, A. S., & Doshi‐Velez, F. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11504 · Cited by 621 · see citing works
Generalizing to Unseen Domains via Adversarial Data AugmentationPreprint
Volpi, R., Namkoong, H., Şener, O., Duchi, J. C., Murino, V., & Savarese, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12018 · Cited by 581 · see citing works
Using Pre-Training Can Improve Model Robustness and UncertaintyPreprint
Hendrycks, D., Lee, K., & Mazeika, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09960 · Cited by 531 · see citing works
Learning to Learn Single Domain Generalization
Qiao, F., Zhao, L., & Peng, X. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01257 · Cited by 476 · see citing works
Overfitting in adversarially robust deep learningPreprint
Rice, L., Wong, E., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11569 · Cited by 472 · cited 3× · see citing works
“Other than CIFAR-10, similar experimental results are observed on multiple datasets, such as SVHN, CIFAR-100, and ImageNet [Rice et al. , 2020].”
BackgroundResult
The Relaxed Online Maximum Margin Algorithm
Li, Y., & Long, P. M. (1999) · Machine-mediated learning · doi:10.1023/a:1012435301888 · Cited by 470 · cited 5× · see citing works
“2, a series of methods [Alayrac et al., 2019; Carmon et al., 2019] leverage semi/unsupervised learning on unlabeled data to enhance the generalization of adversarial training.”
BackgroundMethodResultInfluential
Unlabeled Data Improves Adversarial RobustnessPreprint
Carmon, Y., Raghunathan, A., Schmidt, L., Liang, P., & Duchi, J. C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.13736 · Cited by 440 · cited 2× · see citing works
“From the perspective of generalization, the theory of sample complexity [Schmidt et al. , 2018] explains such a phenomenon partially, and is supported by experimental results in derivative works [Alayrac et al. , 2019; Carmon et al. , 2019].”
MethodResult
Towards the first adversarially robust neural network model on MNISTPreprint
Schott, L., Rauber, J., Bethge, M., & Brendel, W. (2018) · International Conference on Learning Representations · doi:10.48550/arxiv.1805.09190 · Cited by 397 · cited 1× · see citing works
“…various defense strategies, Adversarial Training (AT) [Goodfellow et al. , 2015; Madry et al. , 2018] currently proves to be the most effective against adversarial attacks [Pang et al. , 2020a; Maini et al. , 2020; Schott et al. , 2019], receiving considerable attention from the research community.”
Background
Learning with a Strong AdversaryPreprint
Huang, R., Xu, B., Schuurmans, D., & Szepesvari, C. (2015) · arXiv.org · doi:10.48550/arxiv.1511.03034 · Cited by 381 · cited 4× · see citing works
“The existence of adversarial examples raises concerns from the public and motivates the proposals of defenses [Goodfellow et al. , 2015; Huang et al. , 2015; Madry et al. , 2018].”
BackgroundInfluential
Robust Deep Reinforcement Learning with Adversarial Attacks
Pattanaik, A., Tang, Z.-Y., Liu, S.-J., Bommannan, G., & Chowdhary, G. V. (2017) · Adaptive Agents and Multi-Agent Systems · doi:10.65109/rnct3583 · Cited by 380 · cited 1× · see citing works
“, 2019], audios [Pandey and Wang, 2018], and reinforcement learning [Pattanaik et al., 2017].”
Background
Understanding and Improving Fast Adversarial TrainingPreprint
Andriushchenko, M., & Flammarion, N. (2020) · Neural Information Processing Systems · doi:10.48550/arxiv.2007.02617 · Cited by 368 · cited 3× · see citing works
“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al. , 2019; Wong et al. , 2020] suffer from catastrophic overﬁtting like FGSM-AT.”
Background
Is Robustness the Cost of Accuracy? – A Comprehensive Study on the Robustness of 18 Deep Image Classification Models
Su, D., Zhang, H., Chen, H., Yi, J., Chen, P., & Gao, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01258-8_39 · Cited by 342 · see citing works
Rademacher Complexity for Adversarially Robust GeneralizationPreprint
Yin, D., Ramchandran, K., & Bartlett, P. (2018) · International Conference on Machine Learning · doi:10.48550/arxiv.1810.11914 · Cited by 302 · see citing works
Improving Adversarial Robustness via Promoting Ensemble DiversityPreprint
Pang, T., Xu, K., Du, C., Chen, N., & Zhu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.08846 · Cited by 293 · see citing works
Attacks Which Do Not Kill Training Make Adversarial Learning StrongerPreprint
Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M., & Kankanhalli, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11242 · Cited by 267 · see citing works
Robustness via Curvature Regularization, and Vice Versa
Moosavi-Dezfooli, S.-M., Fawzi, A., Uesato, J., & Frossard, P. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00929 · Cited by 245 · see citing works
On the Convergence and Robustness of Adversarial TrainingPreprint
Wang, Y., Ma, X., Bailey, J., Yi, J., Zhou, B., & Gu, Q. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2112.08304 · Cited by 228 · see citing works
Disentangling Adversarial Robustness and Generalization
Stutz, D., Hein, M., & Schiele, B. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00714 · Cited by 223 · cited 2× · see citing works
“The shreds of evidence in [Yang et al. , 2020b; Stutz et al. , 2019] show that adversarial training might not be the optimal solution for obtaining models with desirable robustness and accuracy.”
BackgroundResult
Transferable Adversarial Attacks for Image and Video Object Detection
Wei, X., Liang, S., Chen, N., & Cao, X. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/134 · Cited by 219 · see citing works
Adversarial Robustness through Local LinearizationPreprint
Qin, C., Martens, J., Gowal, S., Krishnan, D., Dvijotham, K., Fawzi, A., De, S., Stanforth, R., & Kohli, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.02610 · Cited by 218 · see citing works
Are Labels Required for Improving Adversarial Robustness?Preprint
Uesato, J., Alayrac, J.-B., Huang, P.-S., Stanforth, R., Fawzi, A., & Kohli, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.13725 · Cited by 207 · see citing works
Adversarial Examples Are a Natural Consequence of Test Error in NoisePreprint
Ford, N., Gilmer, J., Carlini, N., & Cubuk, E. D. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.10513 · Cited by 197 · see citing works
You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
Zhang, D., Zhang, T., Lu, Y., Zhu, Z., & Dong, B. (2019) · ePrints Soton (University of Southampton) · doi:10.48550/arxiv.1905.00877 · Cited by 196 · see citing works
Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial TrainingPreprint
Zhang, H., & Wang, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.10764 · Cited by 194 · see citing works
Adversarial Training Can Hurt GeneralizationPreprint
Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., & Liang, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.06032 · Cited by 185 · cited 1× · see citing works
“Experiments in [Raghunathan et al., 2019] support this statement, where additional unlabeled data is proved to help mitigate the tradeoff.”
Adversarial Robustness Against the Union of Multiple Perturbation ModelsPreprint
Maini, P., Wong, E., & Kolter, J. (2019) · International Conference on Machine Learning · doi:10.48550/arxiv.1909.04068 · Cited by 182 · see citing works
On the Robustness of the CVPR 2018 White-Box Adversarial Example DefensesPreprint
Athalye, A., & Carlini, N. (2018) · arXiv.org · doi:10.48550/arxiv.1804.03286 · Cited by 176 · cited 1× · see citing works
“Adversarial training is widely accepted as the most effective method in practice to improve the adversarial robustness of deep learning models [Athalye and Carlini, 2018].”
Method
Bag of Tricks for Adversarial TrainingPreprint
Pang, T., Yang, X. H., Dong, Y., Su, H., & Zhu, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.00467 · Cited by 170 · cited 7× · see citing works
“Some replace the fundamental components of models for better performances, like hypersphere embedding [Pang et al. , 2020b], and smoothed ReLU function [Xie et al. , 2020].”
BackgroundMethodInfluential
Adversarially Robust Generalization Just Requires More Unlabeled DataPreprint
Zhai, R., Cai, T., He, D., Dan, C., He, K., Hopcroft, J., & Wang, L. (2019) · arXiv.org · doi:10.48550/arxiv.1906.00555 · Cited by 166 · cited 3× · see citing works
“Following the analysis of Gaussian models in [Schmidt et al. , 2018], a couple of works [Alayrac et al. , 2019; Carmon et al. , 2019; Zhai et al. , 2019] theoretically show that training with unlabeled data signiﬁcantly reduces the sample complexity gap between standard training and robust training.”
BackgroundMethod
MMA Training: Direct Input Space Margin Maximization through Adversarial TrainingPreprint
Ding, G. W., Sharma, Y., Lui, K. Y. C., & Huang, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.02637 · Cited by 162 · cited 5× · see citing works
“28% [Ding et al., 2020] Wide ResNet PGD100 8/255 CIFAR-10 47.”
BackgroundMethodInfluential
Curriculum Adversarial Training
Cai, Q.-Z., Liu, C., & Song, D. X. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/520 · Cited by 157 · see citing works
Metric Learning for Adversarial RobustnessPreprint
Mao, C., Zhong, Z., Yang, J., Vondrick, C., & Ray, B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.00900 · Cited by 154 · see citing works
Evaluating and Understanding the Robustness of Adversarial Logit PairingPreprint
Engstrom, L., Ilyas, A., & Athalye, A. (2018) · arXiv.org · doi:10.48550/arxiv.1807.10272 · Cited by 147 · cited 2× · see citing works
“But ALP initially is not useful due to the wrong formulation of adversarial training objectives [Engstrom et al. , 2018].”
Background
Adversarial training and robustness for multiple perturbations
Tramèr, F., & Boneh, D. (2019) · arXiv · doi:10.48550/arxiv.1904.13000 · Cited by 145 · see citing works
Adversarial Examples in Modern Machine Learning: A ReviewPreprint
Wiyatno, R. R., Xu, A., Dia, O., & de Berker, A. O. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.05268 · Cited by 143 · cited 1× · see citing works
“To our best knowledge, surveys focusing on adversarial training do not exist, as recently proposed surveys [Akhtar and Mian, 2018; Wiyatno et al., 2019] aim at summarizing existing adversarial attacks and defense methods.”
Background
Robustness to Adversarial Perturbations in Learning from Incomplete DataPreprint
Najafi, A., Maeda, S., Koyama, M., & Miyato, T. (2019) · Neural Information Processing Systems · doi:10.48550/arxiv.1905.13021 · Cited by 140 · see citing works
Adversarial Self-Supervised Contrastive LearningPreprint
Kim, M., Tack, J., & Hwang, S. J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.07589 · Cited by 130 · cited 1× · see citing works
“, 2020] where a distributionbased min-max problem is derived from a general view; bilateral adversarial training [Wang and Zhang, 2019] where the model is training on both perturbed images and labels; adversarial training based on feature scatter [Zhang and Wang, 2019], which utilizes a distance metric for sets of nat…”
Background
Robust Pre-Training by Adversarial Contrastive LearningPreprint
Jiang, Z., Chen, T., Chen, T., & Wang, Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.13337 · Cited by 127 · cited 1× · see citing works
“, 2020] where a distributionbased min-max problem is derived from a general view; bilateral adversarial training [Wang and Zhang, 2019] where the model is training on both perturbed images and labels; adversarial training based on feature scatter [Zhang and Wang, 2019], which utilizes a distance metric for sets of nat…”
Background
Improving Adversarial Robustness of Ensembles with Diversity TrainingPreprint
Kariyappa, S., & Qureshi, M. K. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09981 · Cited by 123 · see citing works
Nonconvex Min-Max Optimization: Applications, Challenges, and Recent Theoretical Advances
Razaviyayn, M., Huang, T., Lu, S., Nouiehed, M., Sanjabi, M., & Hong, M. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.3003851 · Cited by 123 · see citing works
Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization
Lee, S., Lee, H., & Yoon, S. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00035 · Cited by 119 · cited 1× · see citing works
“Last, some propose to augment adversarial examples by interpolation, such as AVmixup [Lee et al. , 2020] and adversarial interpolation training [Zhang and Xu, 2020].”
Background
Bilateral Adversarial Training: Towards Fast Training of More Robust Models Against Adversarial Attacks
Wang, J., & Zhang, H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00673 · Cited by 116 · cited 6× · see citing works
“Zhang et al. (2019b) decomposed the robust error as the sum of natural error and the boundary error and provided a tight upper bound for them, theoretically characterizing the trade-off.”
BackgroundMethodInfluential
Instance adaptive adversarial training: Improved accuracy tradeoffs in neural netsPreprint
Balaji, Y., Goldstein, T., & Hoffman, J. (2019) · arXiv.org · doi:10.48550/arxiv.1910.08051 · Cited by 116 · cited 3× · see citing works
“Some works [Balaji et al., 2019; Ding et al., 2020] argued individual data points might have different intrinsic robustness, i.”
Background
Smooth Adversarial TrainingPreprint
Xie, C., Tan, M., Gong, B., Yuille, A., & Le, Q. V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.14536 · Cited by 113 · cited 2× · see citing works
“Some replace the fundamental components of models for better performances, like hypersphere embedding [Pang et al. , 2020b], and smoothed ReLU function [Xie et al. , 2020].”
BackgroundMethod
Opportunities and Challenges in Deep Learning Adversarial Robustness: A SurveyPreprint
Silva, S. H., & Najafirad, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.00753 · Cited by 113 · cited 1× · see citing works
“Toour best knowledge, surveys focusing on adversarial training do not exist so far, and recently proposed surveys [Yuan et al. , 2019; Silva and Najaﬁrad, 2020] mainly summarize existing adversarial attacks and defense methods.”
Background
A taxonomy and terminology of adversarial machine learningPreprint
Tabassi, E., Burns, K. J., Hadjimichael, M., Molina–Markham, A., & Sexton, J. T. (2019) · doi:10.6028/nist.ir.8269-draft · Cited by 103 · cited 1× · see citing works
“Existing surveys are aimed at providing a complete review of adversarial machine learning and summarize all the existing adversarial attacks and defense methods [Yuan et al., 2019; Silva and Najafirad, 2020; Sadeghi et al., 2020; Tabassi et al., 2019; Smith, 2019], which inevitably omit important details of subfields.”
Background
Boosting Adversarial Training with Hypersphere EmbeddingPreprint
Pang, T., Yang, X. H., Dong, Y., Xu, K., Zhu, J., & Su, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.08619 · Cited by 102 · see citing works
Improving the Generalization of Adversarial Training with Domain AdaptationPreprint
Song, C., He, K., Wang, L., & Hopcroft, J. E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.00740 · Cited by 99 · see citing works
Volume 32
Authors, V. (2018) · Journal of Music Theory Pedagogy · doi:10.71156/2994-7073.1198 · Cited by 93 · cited 1×
“Simply combining perturbations with different lp norms in adversarial training proves to be useless as well [Tramer and Boneh, 2019].”
Understanding Catastrophic Overfitting in Single-step Adversarial Training
Kim, H., Lee, W., & Lee, J. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16989 · Cited by 90 · see citing works
CAT: Customized Adversarial Training for Improved Robustness
Cheng, M., Lei, Q., Chen, P., Dhillon, I. S., & Hsieh, C. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/95 · Cited by 83 · cited 3× · see citing works
“The following work, Customized Adversarial Training (CAT) [Cheng et al. , 2020] further applies adaptive label uncertainty to prevent over-conﬁdent predictions based on adaptive ǫ .”
MethodInfluential
A System-Driven Taxonomy of Attacks and Defenses in Adversarial Machine Learning
Sadeghi, K., Banerjee, A., & Gupta, S. K. S. (2020) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2020.2968933 · Cited by 83 · see citing works
Adversarial Distributional Training for Robust Deep LearningPreprint
Dong, Y., Deng, Z., Pang, T., Su, H., & Zhu, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.05999 · Cited by 82 · see citing works
On Adversarial Training and Loss Functions for Speech Enhancement
Pandey, A., & Wang, D.-L. (2018) · IEEE International Conference on Acoustics, Speech, and Signal Processing · doi:10.1109/icassp.2018.8462614 · Cited by 78 · see citing works
DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of EnsemblesPreprint
Yang, H., Zhang, J., Dong, H., Inkawhich, N., Gardner, A., Touchet, A., Wilkes, W., Berry, H., & Li, H. H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.14720 · Cited by 73 · see citing works
Evaluating Robustness of Deep Image Super-Resolution Against Adversarial Attacks
Choi, J. H., Zhang, H., Kim, J., Hsieh, C., & Lee, J. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00039 · Cited by 73 · see citing works
Robust Local Features for Improving the Generalization of Adversarial TrainingPreprint
Song, C., He, K., Lin, J., Wang, L., & Hopcroft, J. E. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.10147 · Cited by 68 · cited 4× · see citing works
“Later many efforts are made to improve generalization empirically, such as adversarial training with semi/unsupervised Learning, AVmixup, and robust local feature [Song et al. , 2020].”
BackgroundInfluential
Single-Step Adversarial Training With Dropout Scheduling
Vivek, B. S., & Babu, R. V. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00103 · Cited by 64 · cited 1× · see citing works
“…of preventing catastrophic overﬁtting, many improvements are proposed like GradAlign [Andriushchenko and Flammarion, 2020], dynamic schedule [Vivek and Babu, 2020b], inner interval veriﬁcation [Kim et al. , 2021], domain adaption [Song et al. , 2019] and regularization meth-ods [Vivek and…”
Background
PAC-learning in the presence of evasion adversariesPreprint
Cullina, D., Bhagoji, A., & Mittal, P. (2018) · Neural Information Processing Systems · doi:10.48550/arxiv.1806.01471 · Cited by 56 · see citing works
Transfer of Adversarial Robustness Between Perturbation TypesPreprint
Kang, D., Sun, Y., Brown, T. B., Hendrycks, D., & Steinhardt, J. (2019) · arXiv.org · doi:10.48550/arxiv.1905.01034 · Cited by 55 · cited 3× · see citing works
“, other lp norms, or larger ǫ, or different target models [Kang et al., 2019].”
BackgroundInfluential
Learning perturbation sets for robust machine learningPreprint
Wong, E., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.08450 · Cited by 52 · see citing works
On the Generalization Properties of Adversarial TrainingPreprint
Xing, Y., Song, Q.-F., & Cheng, G. (2020) · International Conference on Artificial Intelligence and Statistics · doi:10.48550/arxiv.2008.06631 · Cited by 40 · cited 1× · see citing works
“Some variants of adversarial training show better standard generalization empirically, such as adaptive ǫ for adversarial training reviewed in Section 3.2, robust local features [Song et al. , 2020] and L 1 penalty [Xing et al. , 2020].”
Influential
Towards Understanding Fast Adversarial TrainingPreprint
Li, B., Wang, S., Jana, S., & Carin, L. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.03089 · Cited by 27 · see citing works
Attribute-Guided Adversarial Training for Robustness to Natural Perturbations
Gokhale, T., Anirudh, R., Kailkhura, B., Thiagarajan, J. J., Baral, C. R., & Yang, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16927 · Cited by 24 · cited 1× · see citing works
“There are evidences that models trained on such common corruptions show robustness to adversarial examples [Gokhale et al., 2020; Wong and Kolter, 2021].”
Background
Bridging the Performance Gap between FGSM and PGD Adversarial TrainingPreprint
Huang, T., Menkovski, V., Pei, Y., & Pechenizkiy, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.05157 · Cited by 22 · cited 3× · see citing works
“, 2019] and regularization methods [Vivek and Babu, 2020; Huang et al., 2020].”
BackgroundMethod
IEEE Transactions on Emerging Topics in Computational Intelligence
(2021) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2021.3049727 · Cited by 11 · cited 1×
“Existing surveys are aimed at providing a complete review of adversarial machine learning and summarize all the existing adversarial attacks and defense methods [Yuan et al., 2019; Silva and Najafirad, 2020; Sadeghi et al., 2020; Tabassi et al., 2019; Smith, 2019], which inevitably omit important details of subfields.”
Background
Regularizers for Single-step Adversarial TrainingPreprint
Vivek, B. S., & Babu, R. V. (2020) · arXiv.org · doi:10.48550/arxiv.2002.00614 · Cited by 7 · cited 1× · see citing works
“…overﬁtting, many improvements are proposed like GradAlign [Andriushchenko and Flammarion, 2020], dynamic schedule [Vivek and Babu, 2020b], inner interval veriﬁcation [Kim et al. , 2021], domain adaption [Song et al. , 2019] and regularization meth-ods [Vivek and Babu, 2020a; Huang et al. , 2020].”
Background
A Useful Taxonomy for Adversarial Robustness of Neural Networks
Smith, L. (2019) · Trends in Computer Science and Information Technology · doi:10.17352/tcsit.000017 · Cited by 6 · cited 1× · see citing works
“Existing surveys are aimed at providing a complete review of adversarial machine learning and summarize all the existing adversarial attacks and defense methods [Yuan et al., 2019; Silva and Najafirad, 2020; Sadeghi et al., 2020; Tabassi et al., 2019; Smith, 2019], which inevitably omit important details of subfields.”
Background

Flagged first, then by citations

29 of the 130 references couldn’t be matched to a known paper.

Research works printed but not linked: 7

Jacob Buckman, Aurko Roy, Colin Raffel, and Ian J. Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In Proc. of ICLR, 2018.
Quanyu Dai, Xiao Shen, Liang Zhang, Qiang Li, and Dan Wang. Adversarial training methods for network embedding. In The World Wide Web Confer- ence, WWW 2019, San Francisco, CA, USA, May 13-17, 2019, pages 329-339, 2019.
Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi- supervised text classification. In Proc. of ICLR, 2017.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Ad- versarial training for free! In NeurIPS, pages 3353-3364, 2019.
David Stutz, Matthias Hein, and Bernt Schiele. Confidence-calibrated adversarial training: Gen- eralizing to unseen attacks. In ICML, pages 9155-9166, 2020.
Wang et al., 2020] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improv- ing adversarial robustness requires revisiting misclassified examples. In Proc. of ICLR, 2020.
Yang et al., 2020b] Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems, 33, 2020.

Sorted by citations

Unleashing the potential of prompt engineering for large language models
CHEN, B. ‐., Zhang, Z., Langrené, N., & Zhu, S. (2025) · Patterns · doi:10.1016/j.patter.2025.101260 · Cited by 764 · see citing works
GPT (Generative Pre-Trained Transformer)— A Comprehensive Review on Enabling Technologies, Potential Applications, Emerging Challenges, and Future Directions
Yenduri, G., Ramalingam, M., Selvi, G. C., Supriya, Y., Srivastava, G., Maddikunta, P. K. R., Raj, G. D., Jhaveri, R. H., Prabadevi, B., Wang, W., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3389497 · Cited by 759 · see citing works
A Survey on ChatGPT: AI–Generated Contents, Challenges, and Solutions
Wang, Y., Pan, Y., Yan, M., Su, Z., & Luan, T. H. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3300321 · Cited by 395 · see citing works
“Various techniques, such as robust optimization [115], adversarial training [114], and defensive distillation [116], can improve the adversarial robustness of AIGC systems.”
Background
The neuroconnectionist research programme
Doerig, A., Sommers, R. P., Seeliger, K., Richards, B., Ismael, J., Lindsay, G. W., Kording, K. P., Konkle, T., van Gerven, M. A. J., Kriegeskorte, N., et al. (2023) · Nature Reviews Neuroscience · doi:10.1038/s41583-023-00705-w · Cited by 233 · see citing works
Applications of deep learning in precision weed management: A review
Rai, N., Zhang, Y., Ram, B. G., Schumacher, L., Yellavajjala, R. K., Bajwa, S., & Sun, X. (2023) · Computers and Electronics in Agriculture · doi:10.1016/j.compag.2023.107698 · Cited by 218 · see citing works
Robustness in deep learning models for medical diagnostics: security and adversarial challenges towards robust AI applications
Javed, H., El–Sappagh, S., & Abuhmed, T. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-11005-9 · Cited by 205 · see citing works
Explainable Deep Learning Methods in Medical Image Classification: A Survey
Patrício, C., Neves, J. C., & Teixeira, L. F. (2023) · ACM Computing Surveys · doi:10.1145/3625287 · Cited by 190 · see citing works
Adversarial Machine Learning in Wireless Communications Using RF Data: A Review
Adesina, D. S., Hsieh, C.-C. G., Sagduyu, Y. E., & Qian, L. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3205184 · Cited by 184 · see citing works
“These include adversarial training to augment training data with adversarial examples in training phase [14], [17], [190], [191], [192], [193].”
Background
Automated machine learning: past, present and future
Baratchi, M., Wang, C., Limmer, S., van Rijn, J. N., Hoos, H. H., Bäck, T., & Olhofer, M. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10726-1 · Cited by 163 · see citing works
Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Erasers
Huang, C.-P., Chang, K.-P., Tsai, C.-T., Lai, Y.-H., Yang, F.-E., & Wang, Y.-C. F. (2023) · European Conference on Computer Vision · doi:10.48550/arxiv.2311.17717 · Cited by 156
“To defend against such adversarial attacks, various adversarial training strategies have been proposed [3, 15, 26].”
Background
AI Fairness in Data Management and Analytics: A Review on Challenges, Methodologies and Applications
Chen, P., Wu, L., & Wang, L. (2023) · Applied Sciences · doi:10.3390/app131810258 · Cited by 155 · see citing works
A Comprehensive Survey of Deep Learning Approaches in Image Processing
Τρίγκα, Μ., & Dritsas, E. (2025) · Sensors · doi:10.3390/s25020531 · Cited by 159 · see citing works
ChatGPT-Like Large-Scale Foundation Models for Prognostics and Health Management: A Survey and Roadmaps
Li, Y., Wang, H., & Sun, M.-X. (2023) · Reliability Engineering & System Safety · doi:10.48550/arxiv.2305.06472 · Cited by 149
“Explore practical adversarial training and regularization methods [267-269] for LSF-Models to improve the model's ability to resist malicious disturbances and noise.”
Method
Enhancing Noise Robustness of Retrieval-Augmented Language Models with Adaptive Adversarial Training
Fang, F.-T., Bai, Y., Ni, S.-W., Yang, M., Chen, X., & Xu, R.-F. (2024) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2405.20978 · Cited by 137
“Then, the minimization process entails fine-tuning the model’s parameters to enhance its resistance against these meticulously crafted input perturbations (Bai et al., 2021).”
Method
Adversarial Training Methods for Deep Learning: A Systematic Review
Zhao, W.-M., Alwidian, S. A., & Mahmoud, Q. (2022) · Algorithms · doi:10.3390/a15080283 · Cited by 127 · see citing works
“The concept of adversarial trai i i ifi r t eralize the adversarial samples as we l as clean sa ples [5].”
BackgroundMethodInfluential
Toward Trustworthy Artificial Intelligence (TAI) in the Context of Explainability and Robustness
chander, B., John, C., Warrier, L., & Gopalakrishnan, K. (2025) · ACM Computing Surveys · doi:10.1145/3675392 · Cited by 108 · see citing works
“In the context of adaptability, robustness implies that the AI system can learn from new data and adjust its algorithms to keep up with changing market conditions [115].”
Background
Vitron: A Unified Pixel-level Vision LLM for Understanding, Generating, Segmenting, Editing
Fei, H., Wu, S.-Q., Zhang, H., Chua, T.-S., & Yan, S.-C. (2024) · Neural Information Processing Systems · doi:10.48550/arxiv.2412.19806 · Cited by 106
“We employ adversarial training [3] to decouple task-specific from task-invariant features.”
Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
Zheng, B., Jiang, P., Wang, Q., Li, Q. L., Shen, C. Q., Wang, C., Ge, Y., Teng, Q., & Zhang, S. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485383 · Cited by 81 · see citing works
“Adversarial training [40, 61] is one of the most effective defenses against adversarial attacks in the image domain [17].”
BackgroundSelf-citation
Trustworthy federated learning: privacy, security, and beyond
Chen, C., Liu, J., Tan, H., Li, X., Wang, K. I., Li, P., Sakurai, K., & Dou, D. (2024) · Knowledge and Information Systems · doi:10.1007/s10115-024-02285-2 · Cited by 100 · see citing works
“Adversarial training, albeit competent, remains computationally taxing and does not assure comprehensive coverage against all adversarial samples, exposing its limitations [10, 46].”
Distinguishing Reality from AI: Approaches for Detecting Synthetic Content
Ghiurău, D., & Popescu, D. E. (2024) · Computers · doi:10.3390/computers14010001 · Cited by 108 · see citing works
Towards quantum enhanced adversarial robustness in machine learning
West, M. T., Tsang, S.-L., Low, J. S., Hill, C. D., Leckie, C., Hollenberg, L. C. L., Erfani, S. M., & Usman, M. (2023) · Nature Machine Intelligence · doi:10.1038/s42256-023-00661-1 · Cited by 79 · see citing works
“One of the central defensive techniques in classical ML is that of adversarial training , wherein adversarial examples are generated at training time, and included in the training set [8, 12, 13, 62].”
BackgroundMethod
HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Design
Wei, H., Wang, Z.-X., Jia, X., Zheng, Y.-Q., Tang, H.-L., Satoh, S., & Wang, Z. (2022) · AAAI Conference on Artificial Intelligence · doi:10.48550/arxiv.2212.05709 · Cited by 79
“Based on our understanding of HOTCOLD Block, we apply the adversarial training (Bai et al. 2021) that aims to enhance the robustness of models intrinsically.”
Method
Functionality-Preserving Adversarial Machine Learning for Robust Classification in Cybersecurity and Intrusion Detection Domains: A Survey
McCarthy, A., Ghadafi, E., Andriotis, P., & Legg, P. (2022) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp2010010 · Cited by 86 · see citing works
“Robustness can be defined as the performance of well-trained models facing adversarial examples [58].”
Background
AI Security for Geoscience and Remote Sensing: Challenges and future trends
Xu, Y., Bai, T., Yu, W., Chang, S., Atkinson, P. M., & Ghamisi, P. (2023) · IEEE Geoscience and Remote Sensing Magazine · doi:10.1109/mgrs.2023.3272825 · Cited by 84 · see citing works
“Adversarial training [41] is recognized as one of the most effective adversarial defenses against adversarial examples and has been applied widely in computer vision tasks.”
BackgroundSelf-citation
RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
Li, Z., Chen, G., Chen, C., Zou, Y., & Xu, S.-H. (2022) · International Conference on Software Engineering · doi:10.1145/3510003.3510181 · Cited by 78 · see citing works
“From a technical standpoint, RoPGen leverages adversarial training [9, 33, 40].”
BackgroundResult
Benchmarking adversarially robust quantum machine learning at scale
West, M. T., Erfani, S., Leckie, C. A., Sevior, M. E., Hollenberg, L. C. L., & Usman, M. (2023) · Physical Review Research · doi:10.1103/physrevresearch.5.023186 · Cited by 64 · see citing works
“We also investigate the performance of adversarial training of quantum networks under both white box and black box settings, which provides an important new insight that while highly successful for classical networks [12, 17], the benefits of adversarial training are quite insignificant in further”
BackgroundMethodInfluential
Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features
Zhu, M., Wei, S., Zha, H., & Wu, B. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2306.16697 · Cited by 71
“Adversarial training (AT) [1, 2, 25] is an effective technique to improve the robustness of DNNs by incorporating adversarial examples during training.”
Security concerns on machine learning solutions for 6G networks in mmWave beam prediction
Çatak, F. Ö., Kuzlu, M., Çatak, E., Cali, Ü., & Ünal, D. (2022) · Physical Communication · doi:10.1016/j.phycom.2022.101626 · Cited by 65 · see citing works
Artificial Intelligence-Based Underwater Acoustic Target Recognition: A Survey
Feng, S., Ma, S.-Q., Zhu, X.-Q., & Yan, M. (2024) · Remote Sensing · doi:10.3390/rs16173333 · Cited by 65 · see citing works
“Potential solutions include adversarial training [207], adversarial sample detection [208], and defensive distillation [209].”
Background
The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Training
Dong, J., Moosavi-Dezfooli, S.-M., Lai, J., & Xie, X. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02364 · Cited by 44 · see citing works
“Among them, adversarial training consistently remains to be the most effective method [2] to improve intrinsic network robustness via augmenting the training data with adversarial examples.”
Method
Tiny Language Models for Automation and Control: Overview, Potential Applications, and Future Research Directions
Lamaakal, I., Maleh, Y., El Makkaoui, K., Ouahbi, I., Pławiak, P., Alfarraj, O., Almousa, M., & Abd El-Latif, A. A. (2025) · Sensors · doi:10.3390/s25051318 · Cited by 60 · see citing works
“Ensuring secure deployment involves implementing on-device encryption and robust access control measures [169], while adversarial training [170] and model regularization [171] can bolster resistance to manipulation, enhancing security and privacy in TLMs deployment.”
RAIDS: Robust autoencoder-based intrusion detection system model against adversarial attacks
Sarıkaya, A., Günel, B., & Demirci, M. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103483 · Cited by 61 · see citing works
Black-Box Sparse Adversarial Attack via Multi-Objective Optimisation CVPR Proceedings
Williams, P. N., & Li, K. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01183 · Cited by 37 · see citing works
“To address this issue, previous works have emphasized the importance of generating strong adversarial images [3].”
Background
Efficient leukocytes detection and classification in microscopic blood images using convolutional neural network coupled with a dual attention network
Khan, S., Sajjad, M., Abbas, N., Escorcia-Gutierrez, J., Gamarra, A. M. R., & Muhammad, K. (2024) · Comput. Biol. Medicine · doi:10.1016/j.compbiomed.2024.108146 · Cited by 55 · see citing works
SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection
Vitorino, J., Praça, I., & Maia, E. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103433 · Cited by 52 · see citing works
“This augmented training data with more data variations can improve a model’s robustness not only against attack methods similar to the utilized ones, but also against a wide range of attacks that perform different data perturbations [93, 109, 110].”
Background
Harnessing AI for solar energy: Emergence of transformer models
Hanif, M. F., & Mi, J. (2024) · Applied Energy · doi:10.1016/j.apenergy.2024.123541 · Cited by 55 · see citing works
Graph neural networks based log anomaly detection and explanation
Li, Z., Shi, J., & van Leeuwen, M. (2026) · Data Mining and Knowledge Discovery · doi:10.1007/s10618-026-01235-6 · Cited by 8 · see citing works
“Although Logs2Graphs is shown to be robust to very small contamination in the training data, it is critical to improve the model robustness by using techniques such as adversarial training [51] in the future.”
Automatic generation of artificial images of leukocytes and leukemic cells using generative adversarial networks (syntheticcellgan)
Barrera, K., Merino, A., Molina, Á., & Rodellar, J. (2022) · Comput. Methods Programs Biomed. · doi:10.1016/j.cmpb.2022.107314 · Cited by 52 · see citing works
Meta Learning Enabled Adversarial Defense
Tao, Y. (2023) · 2023 IEEE International Conference on Sensors, Electronics and Computer Engineering (ICSECE) · doi:10.1109/icsece58870.2023.10263390 · Cited by 48
“Defenses against adversarial attacks often leverage the knowledge about adversarial examples to improve model robustness, usually through adversarial training [4], which minimizes the adversarial loss against a fixed distortion type.”
Background
Machine Learning for Android Malware Detection: Mission Accomplished? A Comprehensive Review of Open Challenges and Future Perspectives
Guerra-Manzanares, A. (2023) · Computers & security · doi:10.1016/j.cose.2023.103654 · Cited by 46 · see citing works
ImageNet-E: Benchmarking Neural Network Robustness via Attribute Editing
Li, X., Chen, Y., Zhu, Y. P., Wang, S., Zhang, R., & Xue, H. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01951 · Cited by 29 · see citing works
“Adversarial training [42] is one of the state-of-the-art methods for improving the adversarial robustness of deep models and has been widely studied [2].”
Background
PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
Li, D., Cui, S., Li, Y., Xu, J. H., Xiao, F., & Xu, S. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3265665 · Cited by 43 · see citing works
“…training: one aims to select or produce the optimal adversarial examples (e.g., via advanced criterion or new learning strategies [34], [46], [74], [75]); the other aims to analyze statistical properties of resulting models (e.g.,via speciﬁc NN architectures or convexity assumptions [32], [76]).”
Background
Automatic berthing using supervised learning and reinforcement learning
Shimizu, S., Nishihara, K., Miyauchi, Y., Wakita, K., Suyama, R., Maki, A., & Shirakawa, S. (2022) · Ocean Engineering · doi:10.1016/j.oceaneng.2022.112553 · Cited by 47 · see citing works
MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model
Song, K., Lai, H., Pan, Y., & Yin, J. J. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02329 · Cited by 21 · see citing works
“For example, Bai et al. [2] used the adversarial samples as the training data to train the classifier directly.”
MUter: Machine Unlearning on Adversarially Trained Models
Liu, J., Xue, M., Lou, J., Zhang, X., Xiong, L., & Qin, Z. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00451 · Cited by 16 · see citing works
“…retraining-from-scratch approach, while consuming less computation [21–23, The robustness is achieved by the adversarial training model (ATM) [3,24,30,39,59], which is a popular and effective defense for enhancing the model robustness against adversarial examples by creating and…”
Background
Threat Model-Agnostic Adversarial Defense using Diffusion ModelsPreprint
Blau, T., Ganz, R., Kawar, B., Bronstein, A. M., & Elad, M. (2022) · arXiv.org · doi:10.48550/arxiv.2207.08089 · Cited by 40 · see citing works
Fake News Detectors are Biased against Texts Generated by Large Language ModelsPreprint
Su, J., Zhuo, T. Y., Mansurov, J., Wang, D.-M., & Nakov, P. (2023) · arXiv.org · doi:10.48550/arxiv.2309.08674 · Cited by 39 · see citing works
“Our debiasing approach draws inspiration from adversarial training (Bai et al., 2021).”
BackgroundMethod
Reliability Assessment and Safety Arguments for Machine Learning Components in System Assurance
Dong, Y., Huang, W., Bharti, V., Cox, V., Banks, A., Wang, S., Zhao, X., Schewe, S., & Huang, X. (2021) · ACM Transactions on Embedded Computing Systems · doi:10.1145/3570918 · Cited by 39 · see citing works
“[36]) and retraining methods [7] with the RAM, to form a closed loop of debugging-improving-assessing.”
Method
Understanding and Improving Ensemble Adversarial Defense
Deng, Y., & Mu, T. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2310.18477 · Cited by 38
Constraining Adversarial Attacks on Network Intrusion Detection Systems: Transferability and Defense Analysis
Alhussien, N., AlEroud, A. F., Melhem, A., & Khamaiseh, S. Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3357316 · Cited by 38 · see citing works
“It’s also critical to assess whether implementing constraints as part of an adversarial training defense mechanism can improve resilience against AEs [17], and if such defenses are transferable between DL and ML) models.”
Background
Boosting Model Inversion Attacks With Adversarial Examples
Zhou, S., Zhu, T.-Q., Ye, D.-Y., Yu, X., & Zhou, W.-L. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3285015 · Cited by 36 · see citing works
“We also applied this potential defense strategy, adversarial training [37], [38], in our experiments on MNIST, where the FGSM method [39] is used to generate adversarial examples.”
BackgroundMethod
The Best Defense is a Good Offense: Adversarial Augmentation Against Adversarial Attacks
Frosio, I., & Kautz, J. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00396 · Cited by 28 · see citing works
Adversarial machine learning threat analysis and remediation in Open Radio Access Network (O-RAN)
Habler, E., Bitton, R., Avraham, D., Klevansky, E., Mimran, D., Brodt, O., Lehmann, H., Elovici, Y., & Shabtai, A. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104090 · Cited by 24 · see citing works
“Over the past few years, various adversarial training improvements were proposed [51] to improve the efficiency of the training phase and the model’s accuracy in the testing phase.”
Artificial Intelligence to Improve Antibiotic Prescribing: A Systematic Review
Amin, D., Garzόn-Orjuela, N., Garcia Pereira, A., Parveen, S., Vornhagen, H., & Vellinga, A. (2023) · Antibiotics · doi:10.3390/antibiotics12081293 · Cited by 34 · see citing works
“On the other hand, the three remaining studies [44,45,47] did not report biases indicating the chance of bias reproducibility in their predictions; # Robustness of ML models: The robustness of an ML model is how well the model is trained to face adversarial examples [68].”
Background
AI-Driven Real-Time Monitoring of Cardiovascular Conditions With Wearable Devices: Scoping Review
Abedi, A., Verma, A., Jain, D., Kaetheeswaran, J., Chui, C., Lankarany, M., & Khan, S. S. (2025) · JMIR mHealth and uHealth · doi:10.2196/73846 · Cited by 33 · see citing works
“To mitigate such vulnerabilities, techniques such as adversarial training or input preprocessing can be used [76].”
Self-Supervised Speech Quality Estimation and Enhancement Using Only Clean Speech
Fu, S.-W., Hung, K.-H., Tsao, Y., & Wang, Y.-C. F. (2024) · International Conference on Learning Representations · doi:10.48550/arxiv.2402.16321 · Cited by 33
“Step 2-1 (Adversarial attack) : To further improve the robustness of the student model, its encoder and decoder are fine-tuned by adversarial training (AT) (Goodfellow et al., 2014; Bai et al., 2021) with its codebook being fixed.”
Background
Defense Against Adversarial Attacks on Audio DeepFake Detection
Kawa, P., Plata, M., & Syga, P. (2022) · Interspeech · doi:10.48550/arxiv.2212.14597 · Cited by 33
“Answering to the described problem, as well as other common problems associated with adversarial training, such as generalization and (catastrophic) overfitting [20], we propose a new variant of adaptive training approach, in which we continuously analyze which attack is difficult to detect.”
BackgroundMethod
Blackbox Attacks via Surrogate Ensemble Search
Cai, Z., Song, C., Krishnamurthy, S., Roy-Chowdhury, A., & Asif, M. S. (2022) · Neural Information Processing Systems · doi:10.48550/arxiv.2208.03610 · Cited by 33
“Many methods have been proposed in recent years to generate adversarial attacks [2, 5–11] (or to defend against such attacks [6, 12–20]).”
Background
Towards a Better Understanding of Evaluating Trustworthiness in AI Systems
Kemmerzell, N., Schreiner, A., Khalid, H., Schalk, M., & Bordoli, L. (2025) · ACM Computing Surveys · doi:10.1145/3721976 · Cited by 27 · see citing works
CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIP
Xing, S., Zhao, Z., & Sebe, N. (2025) · Computer Vision and Pattern Recognition · doi:10.1109/cvpr52734.2025.01413 · Cited by 32
“The first type is based on adversarial training [3, 58], which alter-nately generates adversarial images on one dataset and uses them to finetune the vision encoder of CLIP [32, 50].”
Drastic Circuit Depth Reductions with Preserved Adversarial Robustness by Approximate Encoding for Quantum Machine Learning
West, M. T., Nakhl, A. C., Heredge, J., Creevey, F. M., Hollenberg, L. C. L., Sevior, M. E., & Usman, M. (2024) · Intelligent Computing · doi:10.34133/icomputing.0100 · Cited by 29 · see citing works
“Indeed, an unexpected discovery of recent years has been the extreme susceptibility of artificial neural networks to careful tampering with their inputs (an “adversarial attack”), which can cause dramatic failures even in sophisticated high-performance models [29, 36, 52–60].”
Background
Hybrid Deep Learning Model using SPCAGAN Augmentation for Insider Threat AnalysisPreprint
Gayathri, R. G., Sajjanhar, A., & Xiang, Y. (2022) · Expert systems with applications · doi:10.48550/arxiv.2203.02855 · Cited by 31 · see citing works
Radio frequency fingerprint identification towards statistical and deep learning features: Review, recent results and future directions
Yan, G.-L., Fu, X., Wang, Y., Zhang, Q.-Y., & Gui, G. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01902-9 · Cited by 30 · see citing works
Energy-Efficient Resource Allocation in Generative AI-Aided Secure Semantic Mobile Networks
Zheng, J., Du, B., Du, H., Kang, J., Niyato, D. T., & Zhang, H. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3396860 · Cited by 34 · see citing works
“This technique enhances models by training them with adversarial examples, as detailed in [21].”
Method
Coupling parameter and particle dynamics for adaptive sampling in Neural Galerkin schemes
Wen, Y., Vanden-Eijnden, E., & Peherstorfer, B. (2023) · Physica A: Statistical Mechanics and its Applications · doi:10.48550/arxiv.2306.15630 · Cited by 30
Semi-supervised Semantics-guided Adversarial Training for Robust Trajectory Prediction
Jiao, R.-C., Liu, X., Sato, T., Chen, Q. A., & Zhu, Q. (2022) · IEEE International Conference on Computer Vision · doi:10.1109/iccv51070.2023.00754 · Cited by 30 · see citing works
Zero-Query Transfer Attacks on Context-Aware Object Detectors
Cai, Z., Rane, S., Brito, A. E., Song, C., Krishnamurthy, S., Roy-Chowdhury, A., & Asif, M. S. (2022) · Computer Vision and Pattern Recognition · doi:10.1109/cvpr52688.2022.01460 · Cited by 30 · see citing works
“Some representative defense mechanisms [43] for mitigating adversarial attacks include enhancing adversarial robustness of the model intrinsically through adversarial training [1,35,51] or strengthening model architectures [31,58]; and destroy adversary externally through input transformation [21, 56] or denoising [36…”
Background
Responsible cognitive digital clones as decision-makers: a design science research study
Golovianko, M., Gryshko, S., Terziyan, V. Y., & Tuunanen, T. (2022) · European Journal of Information Systems · doi:10.1080/0960085x.2022.2073278 · Cited by 37 · see citing works
“This type of learning is based on adversarial ML (Bai et al., 2021; Kumar et al., 2020; Kurakin et al., 2016), in which situations with maximum ignorance and uncertainty are generated and addressed synchronously by humans and clones.”
Background
ART-Point: Improving Rotation Robustness of Point Cloud Classifiers via Adversarial Rotation
Wang, R., Yang, Y., & Tao, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01397 · Cited by 22 · see citing works
“Unlike other defense strategies, adversarial training aims to enhance the robustness of models intrinsically [1].”
Background
Requirements for Trustworthy Artificial Intelligence and its Application in Healthcare
Kim, M., Sohn, H., Choi, S. K., & Kim, S. (2023) · Healthcare Informatics Research · doi:10.4258/hir.2023.29.4.315 · Cited by 33 · see citing works
“In that case, there is a high probability that data will be stolen in one fell swoop if exposed to a person or group who intends malicious use, such as a hacker.”
Background
Towards Viewpoint-Invariant Visual Recognition via Adversarial Training
Ruan, S.-W., Dong, Y.-P., Su, H., Peng, J.-T., Chen, N., & Wei, X. (2023) · IEEE International Conference on Computer Vision · doi:10.1109/iccv51070.2023.00434 · Cited by 28 · see citing works
“[18] and is widely recognized as the most effective way to enhance the robustness of deep learning models [3, 4].”
Background
Invariant Policy Learning: A Causal Perspective
Saengkyongam, S., Thams, N., Peters, J., & Pfister, N. (2021) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3232363 · Cited by 28 · see citing works
“The idea of optimizing worst-case performance has been suggested in the reinforcement learning literature [1], [20] to ensure safe behavior of an agent and prevent catastrophic events and has also been used to formulate adversarial training [4] as well as out-ofdistribution generalization [73].”
Background
Quantum Transfer Learning with Adversarial Robustness for Classification of High‐Resolution Image Datasets
Khatun, A., & Usman, M. (2024) · Advanced Quantum Technologies · doi:10.1002/qute.202400268 · Cited by 25 · see citing works
Internet-of-Things Edge Computing Systems for Streaming Video Analytics: Trails Behind and the Paths Ahead
Ravindran, A. (2023) · IoT · doi:10.3390/iot4040021 · Cited by 27 · see citing works
“Proposed defenses against these attacks require model robustiﬁcation [120], input modiﬁcation for removing perturbations [121], and adding external detectors to the model [122].”
PANACEA: A Neural Model Ensemble for Cyber-Threat Detection
Al-Essa, M., Andresini, G., Appice, A., & Malerba, D. (2023) · International Conference on Data Science and Advanced Analytics · doi:10.1007/s10994-023-06470-2 · Cited by 27 · see citing works
“In addition, we explore the performance of PANACEA with 𝜖 = 0.2 , although the study of Bai et al. (2021) suggested the generation of adversarial samples with small perturbations obtained with 𝜖 ≤ 0.1 .”
Influential
An XAI-based adversarial training approach for cyber-threat detection
Al-Essa, M., Andresini, G., Appice, A., & Malerba, D. (2022) · 2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/dasc/picom/cbdcom/cy55231.2022.9927842 · Cited by 27 · see citing works
Learning to Fool the Speaker Recognition
Li, J., Zhang, X.-F., Xu, J.-Z., Zhang, L., Wang, Y., Ma, S.-W., & Gao, W. (2020) · IEEE International Conference on Acoustics, Speech, and Signal Processing · doi:10.1109/icassp40776.2020.9053058 · Cited by 27 · see citing works
“24 KS5 [1, 1, 1, 1, 1] [5] × 5 [32] × 5 98.”
Method
Transferable Adversarial Attacks for Remote Sensing Object Recognition via Spatial- Frequency Co-Transformation
Fu, Y.-M., Liu, Z.-G., & Lyu, J. (2024) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2024.3443403 · Cited by 27 · see citing works
“Adversarial training [38] includes adversarial examples into the training process, thereby making the model resistant to attacks.”
Background
Cracking SQL Barriers: An LLM-based Dialect Translation System
Zhou, W., Gao, Y.-Y., Zhou, X.-H., & Li, G.-L. (2025) · Proc. ACM Manag. Data · doi:10.1145/3725278 · Cited by 26 · see citing works
An Approach for EEG Denoising Based on Wasserstein Generative Adversarial Network
Dong, Y., Tang, X., Li, Q., Wang, Y.-Y., Jiang, N.-F., Tian, L., Zheng, Y., Li, X., Zhao, S.-F., Li, G.-L., et al. (2023) · IEEE transactions on neural systems and rehabilitation engineering · doi:10.1109/tnsre.2023.3309815 · Cited by 26 · see citing works
“Adversarial training [37] can solve this problem by enhancing the robustness of the model intrinsically, and Generative Adversarial Network (GAN) is one of the most represen-”
Background
Improving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing
Bai, Y., Anderson, B., Kim, A., & Sojoudi, S. (2023) · SIAM Journal on Mathematics of Data Science · doi:10.48550/arxiv.2301.12554 · Cited by 26
“Moreover, standard non-robust models often achieve enormous performance gains by pre-training on larger datasets with self-or semi-supervision [42, 15].”
Background
ELAT: Ensemble Learning with Adversarial Training in defending against evaded intrusions
Lin, Y., Pratama, J.-H., Sudyana, D., Lai, Y., Hwang, R., Lin, P., Lin, H., Lee, W., & Chiang, C.-K. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103348 · Cited by 16 · see citing works
“In adversarial training, the model is trained with adversarial samples, so that it is smart enough to detect adversarial attacks injected into a dataset [6].”
Background
Why adversarial training can hurt robust accuracyPreprint
Clarysse, J., Hörrmann, J., & Yang, F. (2022) · International Conference on Learning Representations · doi:10.48550/arxiv.2203.02006 · Cited by 26 · see citing works
“In the literature so far, it is widely acknowledged that adversarial training with the same perturbation type and budget as during test time often achieves significantly lower adversarial error than standard training (Madry et al., 2018; Zhang et al., 2019; Bai et al., 2021).”
Background
Assessing the Reliability of Deep Learning Classifiers Through Robustness Evaluation and Operational Profiles
Zhao, X., Huang, W., Banks, A., Cox, V., Flynn, D., Schewe, S., & Huang, X. (2021) · AISafety@IJCAI · doi:10.48550/arxiv.2106.01258 · Cited by 27
“As described in [Zhao et al. , 2021], we plan to investigate DL de-bug testing (e.g. [Huang et al. , 2021]) and retraining methods [Bai et al. , 2021], together with the RAM, to form a closed loop of debugging-improving-assessing.”
Method
On the Importance of Backbone to the Adversarial Robustness of Object Detectors
Li, X., Chen, H., & Hu, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3542964 · Cited by 14 · see citing works
“Adversarial training and its variants [37, 45, 3] are generally recognized as the most effective defense methods against adversarial examples, which improve adversarial robustness of classifiers by incorporating adversarial examples into training:”
Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical World
Hu, C.-H., Shi, W.-W., Jiang, T.-S., Yao, W., Tian, L., & Chen, X.-Q. (2023) · doi:10.48550/arxiv.2304.10712 · Cited by 24
“Adversarial training [49] is a common and effective defense technique that fundamentally enhances the model’s resistance to adversarial attacks.”
Background
Do Perceptually Aligned Gradients Imply Robustness?
Ganz, R., Kawar, B., & Elad, M. (2022) · International Conference on Machine Learning · doi:10.48550/arxiv.2207.11378 · Cited by 24
“This limitation was listed by (Hendrycks et al., 2021; Bai et al., 2021) as one of the major unsolved problems of adversarial training methods.”
Background
A Comprehensive Review of Neuro-symbolic AI for Robustness, Uncertainty Quantification, and Intervenability
Acharya, K., & Song, H. (2025) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-025-10887-3 · Cited by 26 · see citing works
“Adversarial robustness [35] focuses on worst case, human orchestrated perturbations crafted explicitly to induce misclassiﬁcation, while non-adversarial robustness [36] evaluates resilience to random noise sources such as Gaussian blur, sensor noise, or missing pixels that are not chosen by an…”
A Wolf in Sheep's Clothing: Practical Black-box Adversarial Attacks for Evading Learning-based Windows Malware Detection in the Wild
Ling, X., Wu, Z.-Y., Wang, B., Deng, W., Wu, J.-Z., Ji, S.-L., Luo, T.-Y., & Wu, Y.-J. (2024) · USENIX Security Symposium · doi:10.48550/arxiv.2407.02886 · Cited by 23
“(1) Adversarial training : Adversarial training is recognized as one of the most effective defenses against adversarial attacks [9].”
Background
Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
Shen, L., Pu, Y., Ji, S.-L., Li, C., Zhang, X., Ge, C., & Wang, T. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24115 · Cited by 23 · see citing works
“Moreover, to obtain knowledge from adversarial examples, it is usually necessary to update all model parameters [48], which may reduce the model’s generalization ability [47], [2], [7].”
Background
Regularization properties of adversarially-trained linear regression
Ribeiro, A. H., Zachariah, D., Bach, F. R., & Schön, T. B. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2310.10807 · Cited by 23
“Adversarial training [7] is one of the most effective approaches for deep learning models to defend against adversarial attacks [7]–[9].”
Background
Conceptualizing the Secure Machine Learning Operations (SecMLOps) Paradigm
Zhang, X., & Jaskolka, J. (2022) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs57517.2022.00023 · Cited by 16 · see citing works
“Data scientists specialized in security or the internal security experts have the knowledge of adversarial ML and various training techniques [31], [32].”
Background
Lying with Truths: Open-Channel Multi-Agent Collusion for Belief Manipulation via Generative Montage
Hu, J., Huang, X.-M., Sun, Y., Dong, Y., & Huang, X.-W. (2026) · Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2026.acl-long.270 · Cited by 22
“At the training level, adversarial robustness techniques could expose agents to edited sequences during fine-tuning (Bai et al., 2021; Hu et al., 2025d) to resist strategic evidence curation, while machine unlearning could erase internalized false beliefs or prune vulnerable reasoning patterns (Liu…”
Enhancing CLIP Robustness via Cross-Modality Alignment
Zhu, X.-Y., Zhu, B.-E., Wang, S., Zhao, K., & Zhang, H.-W. (2025) · Neural Information Processing Systems · doi:10.48550/arxiv.2510.24038 · Cited by 22
Adversarial Attacks and Defense Technologies on Autonomous Vehicles: A Review
Mahima, K. T. Y., Ayoob, M., & Poravi, G. (2021) · Applied Computer Systems · doi:10.2478/acss-2021-0012 · Cited by 22
Universal Adversarial Attacks on Neural Networks for Power Allocation in a Massive MIMO System
Santos, P. M., Manoj, B., Sadeghi, M., & Larsson, E. G. (2021) · IEEE Wireless Communications Letters · doi:10.1109/lwc.2021.3120290 · Cited by 22 · see citing works
Adversarial infrared blocks: A multi-view black-box attack to thermal infrared detectors in physical world
Hu, C.-H., Shi, W.-W., Jiang, T.-S., Yao, W., Tian, L., Chen, X.-Q., Zhou, J.-Z., & Li, W. (2024) · Neural Networks · doi:10.1016/j.neunet.2024.106310 · Cited by 21 · see citing works
Recent Advances in Neural Text Generation: A Task-Agnostic SurveyPreprint
Tang, C., Guerin, F., Li, Y., & Lin, C.-H. (2022) · arXiv.org · doi:10.48550/arxiv.2203.03047 · Cited by 21 · see citing works
“Adversarial Training is a kind of data augmentation strategy, which learns from adversarial samples, and improves the performance and robustness of neural models (Jiang et al., 2020; Bai et al., 2021).”
Background
Detecting Adversarial Perturbations in Multi-Task Perception
Klingner, M., Kumar, V., Yogamani, S., Bär, A., & Fingscheidt, T. (2022) · IEEE/RJS International Conference on Intelligent RObots and Systems · doi:10.1109/iros47612.2022.9981559 · Cited by 21 · see citing works
“Still, all perturbations are reliably detected for (cid:15) ≥ 8 , while smaller perturbations could potentially be defended by more robust training methods [39].”
CamoPatch: An Evolutionary Strategy for Generating Camoflauged Adversarial Patches
Li, K., & Williams, P. (2023) · Advances in Neural Information Processing Systems 36 · doi:10.52202/075280-2939 · Cited by 21
“As a result, developing methods to generate adversarial images has emerged as a critical research area for assessing the robustness of DNNs [3].”
Method

Authors: Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q.
Affiliations: Nanyang Technological University (SG)
Wuhan University (CN)
ORCID: Bai, Tao
Luo, Jinqi
Zhao, Jun
Wen, Bihan
Wang, Qian
Venue: arXiv
Publisher: arXiv
Published: 2021
Pages: 4312-4321
DOI: 10.48550/arxiv.2102.01356
arXiv: 2102.01356
OpenAlex: W3191453585
Cited by: 490
References: 130
Citations by year: 2026: 56 · 2025: 116 · 2024: 144 · 2023: 108 · 2022: 49 · 2021: 17
FWCI: 36.73
Type: conference paper
Language: en
Open access: bronze
doi.org
Licence: arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations: International Joint Conference on Artificial Intelligence (publishedVersion)
arXiv (Cornell University) (submittedVersion)
arXiv (Cornell University)
Funders: National Research Foundation
National Natural Science Foundation of China (U20B2049, 61822207)
Ministry of Education, India
Topics: Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords: adversarial training, adversarial robustness, adversarial examples

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Recent Advances in Adversarial Training for Adversarial Robustness

Abstract

Integrity signals

Claims the paper makes

Claims other papers make about this one

Self-check

Cites

Cited by

Record

About these checks