The DOI matches its DataCite record; 101 of the 130 references it cites were found in a registry or an index.
Recent Advances in Adversarial Training for Adversarial Robustness
Open accessAbstract
Adversarial training is one of the most effective approaches defending against adversarial examples for deep learning models. Unlike other defense strategies, adversarial training aims to promote the robustness of models intrinsically. During the last few years, adversarial training has been studied and discussed from various aspects. A variety of improvements and developments of adversarial training are proposed, which were, however, neglected in existing surveys. For the first time in this survey, we systematically review the recent progress on adversarial training for adversarial robustness with a novel taxonomy. Then we discuss the generalization problems in adversarial training from three perspectives. Finally, we highlight the challenges which are not fully tackled and present potential future directions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial training [201] is widely adopted to improve model robustness against adversarial attacks by incorporating adversarial examples into the training process.”
From Deepfake detection across image, video, and audio: a comprehensive survey with empirical evaluation of generalization and robustness (2026) · cites this paper as [201]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Marsden, W. (2012) · doi:10.1017/cbo9781139207249.009 · Cited by 170,911 · cited 5×
“Su et al. (2018) evaluated the recent SOTA ImageNet-based DNN models on multiple robustness metrics.”
MethodResultInfluentialRosenbloom, L. (2019) · Charleston Advisor · doi:10.5260/chara.21.2.8 · Cited by 16,663 · cited 4×
“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al.”
MethodResultInfluentialExplaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · cited 15×
“The adversarial counterpart x ′ of x is expressed as There are some common attacks following this formulation like Fast Gradient Sign Method (FGSM) [Goodfellow et al. , 2015], iterative FGSM [Kurakin et al. , 2016], and Projected Gradient Descent (PGD) attack [Madry et al. , 2018].”
BackgroundMethodInfluentialIntriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · cited 12×
“Current adversarial training methods [Madry et al. , 2018] can produce a robust model with worst-case accuracy of around 90% on MNIST.”
BackgroundMethodInfluentialmixup: Beyond Empirical Risk Minimization
Zhang, H., Cisse, M., Dauphin, Y. N., & Lopez-Paz, D. (2017) · arXiv · doi:10.48550/arxiv.1710.09412 · Cited by 5,831 · cited 1×
“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al., 2018] and early stopping, where early stopping is found to be the most effective.”
MethodAdversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · cited 2×
“, 2015], iterative FGSM [Kurakin et al., 2016], and Projected Gradient Descent (PGD) attack [Madry et al.”
BackgroundMethodPractical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495
Improved regularization of convolutional neural networks with cutout
DeVries, T., & Taylor, G. W. (2017) · arXiv · doi:10.48550/arxiv.1708.04552 · Cited by 2,776 · cited 1×
“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al.”
MethodAdversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325 · cited 1×
“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”
Background
Research works printed but not linked: 7
- Jacob Buckman, Aurko Roy, Colin Raffel, and Ian J. Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In Proc. of ICLR, 2018.
- Quanyu Dai, Xiao Shen, Liang Zhang, Qiang Li, and Dan Wang. Adversarial training methods for network embedding. In The World Wide Web Confer- ence, WWW 2019, San Francisco, CA, USA, May 13-17, 2019, pages 329-339, 2019.
- Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi- supervised text classification. In Proc. of ICLR, 2017.
- Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Ad- versarial training for free! In NeurIPS, pages 3353-3364, 2019.
- David Stutz, Matthias Hein, and Bernt Schiele. Confidence-calibrated adversarial training: Gen- eralizing to unseen attacks. In ICML, pages 9155-9166, 2020.
- Wang et al., 2020] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improv- ing adversarial robustness requires revisiting misclassified examples. In Proc. of ICLR, 2020.
- Yang et al., 2020b] Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems, 33, 2020.
Cited by
Sorted by citations
Unleashing the potential of prompt engineering for large language models
CHEN, B. ‐., Zhang, Z., Langrené, N., & Zhu, S. (2025) · Patterns · doi:10.1016/j.patter.2025.101260 · Cited by 1,097
Yenduri, G., Ramalingam, M., Selvi, G. C., Supriya, Y., Srivastava, G., Maddikunta, P. K. R., Raj, G. D., Jhaveri, R. H., Prabadevi, B., Wang, W., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3389497 · Cited by 916
A Survey on ChatGPT: AI–Generated Contents, Challenges, and Solutions
Wang, Y., Pan, Y., Yan, M., Su, Z., & Luan, T. H. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3300321 · Cited by 436
“Various techniques, such as robust optimization [115], adversarial training [114], and defensive distillation [116], can improve the adversarial robustness of AIGC systems.”
BackgroundThe neuroconnectionist research programme
Doerig, A., Sommers, R. P., Seeliger, K., Richards, B., Ismael, J., Lindsay, G. W., Kording, K. P., Konkle, T., van Gerven, M. A. J., Kriegeskorte, N., et al. (2023) · Nature Reviews Neuroscience · doi:10.1038/s41583-023-00705-w · Cited by 233
Applications of deep learning in precision weed management: A review
Rai, N., Zhang, Y., Ram, B. G., Schumacher, L., Yellavajjala, R. K., Bajwa, S., & Sun, X. (2023) · Computers and Electronics in Agriculture · doi:10.1016/j.compag.2023.107698 · Cited by 218
Javed, H., El–Sappagh, S., & Abuhmed, T. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-11005-9 · Cited by 228
Explainable Deep Learning Methods in Medical Image Classification: A Survey
Patrício, C., Neves, J. C., & Teixeira, L. F. (2023) · ACM Computing Surveys · doi:10.1145/3625287 · Cited by 207
Adversarial Machine Learning in Wireless Communications Using RF Data: A Review
Adesina, D. S., Hsieh, C.-C. G., Sagduyu, Y. E., & Qian, L. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3205184 · Cited by 205
“These include adversarial training to augment training data with adversarial examples in training phase [14], [17], [190], [191], [192], [193].”
BackgroundAutomated machine learning: past, present and future
Baratchi, M., Wang, C., Limmer, S., van Rijn, J. N., Hoos, H. H., Bäck, T., & Olhofer, M. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10726-1 · Cited by 178
Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Erasers
Huang, C.-P., Chang, K.-P., Tsai, C.-T., Lai, Y.-H., Yang, F.-E., & Wang, Y.-C. F. (2023) · European Conference on Computer Vision · doi:10.48550/arxiv.2311.17717 · Cited by 156
“To defend against such adversarial attacks, various adversarial training strategies have been proposed [3, 15, 26].”
BackgroundAI Fairness in Data Management and Analytics: A Review on Challenges, Methodologies and Applications
Chen, P., Wu, L., & Wang, L. (2023) · Applied Sciences · doi:10.3390/app131810258 · Cited by 155
A Comprehensive Survey of Deep Learning Approaches in Image Processing
Τρίγκα, Μ., & Dritsas, E. (2025) · Sensors · doi:10.3390/s25020531 · Cited by 174
Li, Y., Wang, H., & Sun, M.-X. (2023) · Reliability Engineering & System Safety · doi:10.48550/arxiv.2305.06472 · Cited by 149
“Explore practical adversarial training and regularization methods [267-269] for LSF-Models to improve the model's ability to resist malicious disturbances and noise.”
MethodEnhancing Noise Robustness of Retrieval-Augmented Language Models with Adaptive Adversarial Training
Fang, F.-T., Bai, Y., Ni, S.-W., Yang, M., Chen, X., & Xu, R.-F. (2024) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2405.20978 · Cited by 137
“Then, the minimization process entails fine-tuning the model’s parameters to enhance its resistance against these meticulously crafted input perturbations (Bai et al., 2021).”
MethodAdversarial Training Methods for Deep Learning: A Systematic Review
Zhao, W., Alwidian, S., & Mahmoud, Q. H. (2022) · Algorithms · doi:10.3390/a15080283 · Cited by 153
“The concept of adversarial trai i i ifi r t eralize the adversarial samples as we l as clean sa ples [5].”
BackgroundMethodInfluentialToward Trustworthy Artificial Intelligence (TAI) in the Context of Explainability and Robustness
chander, B., John, C., Warrier, L., & Gopalakrishnan, K. (2025) · ACM Computing Surveys · doi:10.1145/3675392 · Cited by 108
“In the context of adaptability, robustness implies that the AI system can learn from new data and adjust its algorithms to keep up with changing market conditions [115].”
BackgroundVitron: A Unified Pixel-level Vision LLM for Understanding, Generating, Segmenting, Editing
Fei, H., Wu, S.-Q., Zhang, H., Chua, T.-S., & Yan, S.-C. (2024) · Neural Information Processing Systems · doi:10.48550/arxiv.2412.19806 · Cited by 106
“We employ adversarial training [3] to decouple task-specific from task-invariant features.”
Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
Zheng, B., Jiang, P., Wang, Q., Li, Q. L., Shen, C. Q., Wang, C., Ge, Y., Teng, Q., & Zhang, S. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485383 · Cited by 82
“Adversarial training [40, 61] is one of the most effective defenses against adversarial attacks in the image domain [17].”
BackgroundSelf-citationTrustworthy federated learning: privacy, security, and beyond
Chen, C., Liu, J., Tan, H., Li, X., Wang, K. I., Li, P., Sakurai, K., & Dou, D. (2024) · Knowledge and Information Systems · doi:10.1007/s10115-024-02285-2 · Cited by 110
“Adversarial training, albeit competent, remains computationally taxing and does not assure comprehensive coverage against all adversarial samples, exposing its limitations [10, 46].”
Distinguishing Reality from AI: Approaches for Detecting Synthetic Content
Ghiurău, D., & Popescu, D. E. (2024) · Computers · doi:10.3390/computers14010001 · Cited by 122
Towards quantum enhanced adversarial robustness in machine learning
West, M. T., Tsang, S.-L., Low, J. S., Hill, C. D., Leckie, C., Hollenberg, L. C. L., Erfani, S. M., & Usman, M. (2023) · Nature Machine Intelligence · doi:10.1038/s42256-023-00661-1 · Cited by 79
“One of the central defensive techniques in classical ML is that of adversarial training , wherein adversarial examples are generated at training time, and included in the training set [8, 12, 13, 62].”
BackgroundMethodHOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Design
Wei, H., Wang, Z.-X., Jia, X., Zheng, Y.-Q., Tang, H.-L., Satoh, S., & Wang, Z. (2022) · AAAI Conference on Artificial Intelligence · doi:10.48550/arxiv.2212.05709 · Cited by 79
“Based on our understanding of HOTCOLD Block, we apply the adversarial training (Bai et al. 2021) that aims to enhance the robustness of models intrinsically.”
MethodMcCarthy, A., Ghadafi, E., Andriotis, P., & Legg, P. (2022) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp2010010 · Cited by 86
“Robustness can be defined as the performance of well-trained models facing adversarial examples [58].”
BackgroundAI Security for Geoscience and Remote Sensing: Challenges and future trends
Xu, Y., Bai, T., Yu, W., Chang, S., Atkinson, P. M., & Ghamisi, P. (2023) · IEEE Geoscience and Remote Sensing Magazine · doi:10.1109/mgrs.2023.3272825 · Cited by 92
“Adversarial training [41] is recognized as one of the most effective adversarial defenses against adversarial examples and has been applied widely in computer vision tasks.”
BackgroundSelf-citationLi, Z., Chen, G. (., Chen, C., Zou, Y., & Xu, S. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510181 · Cited by 61
“From a technical standpoint, RoPGen leverages adversarial training [9, 33, 40].”
BackgroundResultBenchmarking adversarially robust quantum machine learning at scale
West, M. T., Erfani, S., Leckie, C. A., Sevior, M. E., Hollenberg, L. C. L., & Usman, M. (2023) · Physical Review Research · doi:10.1103/physrevresearch.5.023186 · Cited by 78
“We also investigate the performance of adversarial training of quantum networks under both white box and black box settings, which provides an important new insight that while highly successful for classical networks [12, 17], the benefits of adversarial training are quite insignificant in further”
BackgroundMethodInfluentialNeural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features
Zhu, M., Wei, S., Zha, H., & Wu, B. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2306.16697 · Cited by 71
“Adversarial training (AT) [1, 2, 25] is an effective technique to improve the robustness of DNNs by incorporating adversarial examples during training.”
Security concerns on machine learning solutions for 6G networks in mmWave beam prediction
Çatak, F. Ö., Kuzlu, M., Çatak, E., Cali, Ü., & Ünal, D. (2022) · Physical Communication · doi:10.1016/j.phycom.2022.101626 · Cited by 65
Artificial Intelligence-Based Underwater Acoustic Target Recognition: A Survey
Feng, S., Ma, S., Zhu, X., & Yan, M. (2024) · Remote Sensing · doi:10.3390/rs16173333 · Cited by 68
“Potential solutions include adversarial training [207], adversarial sample detection [208], and defensive distillation [209].”
BackgroundThe Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Training
Dong, J., Moosavi-Dezfooli, S.-M., Lai, J., & Xie, X. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02364 · Cited by 47
“Among them, adversarial training consistently remains to be the most effective method [2] to improve intrinsic network robustness via augmenting the training data with adversarial examples.”
MethodLamaakal, I., Maleh, Y., El Makkaoui, K., Ouahbi, I., Pławiak, P., Alfarraj, O., Almousa, M., & Abd El-Latif, A. A. (2025) · Sensors · doi:10.3390/s25051318 · Cited by 60
“Ensuring secure deployment involves implementing on-device encryption and robust access control measures [169], while adversarial training [170] and model regularization [171] can bolster resistance to manipulation, enhancing security and privacy in TLMs deployment.”
RAIDS: Robust autoencoder-based intrusion detection system model against adversarial attacks
Sarıkaya, A., Günel, B., & Demirci, M. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103483 · Cited by 61
Black-Box Sparse Adversarial Attack via Multi-Objective Optimisation CVPR Proceedings
Williams, P. N., & Li, K. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01183 · Cited by 41
“To address this issue, previous works have emphasized the importance of generating strong adversarial images [3].”
BackgroundKhan, S. M., Sajjad, M., Abbas, N., Escorcia‐Gutierrez, J., Gamarra, M., & Muhammad, K. (2024) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2024.108146 · Cited by 58
SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection
Vitorino, J., Praça, I., & Maia, E. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103433 · Cited by 57
“This augmented training data with more data variations can improve a model’s robustness not only against attack methods similar to the utilized ones, but also against a wide range of attacks that perform different data perturbations [93, 109, 110].”
BackgroundHarnessing AI for solar energy: Emergence of transformer models
Hanif, M. F., & Mi, J. (2024) · Applied Energy · doi:10.1016/j.apenergy.2024.123541 · Cited by 58
Graph neural networks based log anomaly detection and explanation
Li, Z., Shi, J., & van Leeuwen, M. (2026) · Data Mining and Knowledge Discovery · doi:10.1007/s10618-026-01235-6 · Cited by 16
“Although Logs2Graphs is shown to be robust to very small contamination in the training data, it is critical to improve the model robustness by using techniques such as adversarial training [51] in the future.”
Barrera, K., Merino, A., Molina, Á., & Rodellar, J. (2022) · Computer Methods and Programs in Biomedicine · doi:10.1016/j.cmpb.2022.107314 · Cited by 59
Meta Learning Enabled Adversarial Defense
Tao, Y. (2023) · 2023 IEEE International Conference on Sensors, Electronics and Computer Engineering (ICSECE) · doi:10.1109/icsece58870.2023.10263390 · Cited by 48
“Defenses against adversarial attacks often leverage the knowledge about adversarial examples to improve model robustness, usually through adversarial training [4], which minimizes the adversarial loss against a fixed distortion type.”
BackgroundGuerra-Manzanares, A. (2023) · Computers & security · doi:10.1016/j.cose.2023.103654 · Cited by 46
ImageNet-E: Benchmarking Neural Network Robustness via Attribute Editing
Li, X., Chen, Y., Zhu, Y. P., Wang, S., Zhang, R., & Xue, H. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01951 · Cited by 32
“Adversarial training [42] is one of the state-of-the-art methods for improving the adversarial robustness of deep models and has been widely studied [2].”
BackgroundPAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
Li, D., Cui, S., Li, Y., Xu, J. H., Xiao, F., & Xu, S. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3265665 · Cited by 44
“…training: one aims to select or produce the optimal adversarial examples (e.g., via advanced criterion or new learning strategies [34], [46], [74], [75]); the other aims to analyze statistical properties of resulting models (e.g.,via specific NN architectures or convexity assumptions [32], [76]).”
BackgroundAutomatic berthing using supervised learning and reinforcement learning
Shimizu, S., Nishihara, K., Miyauchi, Y., Wakita, K., Suyama, R., Maki, A., & Shirakawa, S. (2022) · Ocean Engineering · doi:10.1016/j.oceaneng.2022.112553 · Cited by 47
MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model
Song, K., Lai, H., Pan, Y., & Yin, J. J. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02329 · Cited by 24
“For example, Bai et al. [2] used the adversarial samples as the training data to train the classifier directly.”
MUter: Machine Unlearning on Adversarially Trained Models
Liu, J., Xue, M., Lou, J., Zhang, X., Xiong, L., & Qin, Z. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00451 · Cited by 16
“…retraining-from-scratch approach, while consuming less computation [21–23, The robustness is achieved by the adversarial training model (ATM) [3,24,30,39,59], which is a popular and effective defense for enhancing the model robustness against adversarial examples by creating and…”
BackgroundThreat Model-Agnostic Adversarial Defense using Diffusion ModelsPreprint
Blau, T., Ganz, R., Kawar, B., Bronstein, A. M., & Elad, M. (2022) · arXiv.org · doi:10.48550/arxiv.2207.08089 · Cited by 40
Fake News Detectors are Biased against Texts Generated by Large Language ModelsPreprint
Su, J., Zhuo, T. Y., Mansurov, J., Wang, D., & Nakov, P. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2309.08674 · Cited by 66
“Our debiasing approach draws inspiration from adversarial training (Bai et al., 2021).”
BackgroundMethodReliability Assessment and Safety Arguments for Machine Learning Components in System Assurance
Dong, Y., Huang, W., Bharti, V., Cox, V. A., Banks, A., Wang, S., Zhao, X., Schewe, S., & Huang, X. (2022) · ACM Transactions on Embedded Computing Systems · doi:10.1145/3570918 · Cited by 56
“[36]) and retraining methods [7] with the RAM, to form a closed loop of debugging-improving-assessing.”
MethodUnderstanding and Improving Ensemble Adversarial Defense
Deng, Y., & Mu, T. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2310.18477 · Cited by 38
Alhussien, N., AlEroud, A. F., Melhem, A., & Khamaiseh, S. Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3357316 · Cited by 38
“It’s also critical to assess whether implementing constraints as part of an adversarial training defense mechanism can improve resilience against AEs [17], and if such defenses are transferable between DL and ML) models.”
BackgroundBoosting Model Inversion Attacks With Adversarial Examples
Zhou, S., Zhu, T., Ye, D., Yu, X., & Zhou, W. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3285015 · Cited by 36
“We also applied this potential defense strategy, adversarial training [37], [38], in our experiments on MNIST, where the FGSM method [39] is used to generate adversarial examples.”
BackgroundMethodThe Best Defense is a Good Offense: Adversarial Augmentation Against Adversarial Attacks
Frosio, I., & Kautz, J. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00396 · Cited by 30
Adversarial machine learning threat analysis and remediation in Open Radio Access Network (O-RAN)
Habler, E., Bitton, R., Avraham, D., Klevansky, E., Mimran, D., Brodt, O., Lehmann, H., Elovici, Y., & Shabtai, A. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104090 · Cited by 24
“Over the past few years, various adversarial training improvements were proposed [51] to improve the efficiency of the training phase and the model’s accuracy in the testing phase.”
Artificial Intelligence to Improve Antibiotic Prescribing: A Systematic Review
Amin, D., Garzόn-Orjuela, N., Garcia Pereira, A., Parveen, S., Vornhagen, H., & Vellinga, A. (2023) · Antibiotics · doi:10.3390/antibiotics12081293 · Cited by 34
“On the other hand, the three remaining studies [44,45,47] did not report biases indicating the chance of bias reproducibility in their predictions; # Robustness of ML models: The robustness of an ML model is how well the model is trained to face adversarial examples [68].”
BackgroundAI-Driven Real-Time Monitoring of Cardiovascular Conditions With Wearable Devices: Scoping Review
Abedi, A., Verma, A., Jain, D., Kaetheeswaran, J., Chui, C., Lankarany, M., & Khan, S. S. (2025) · JMIR mHealth and uHealth · doi:10.2196/73846 · Cited by 33
“To mitigate such vulnerabilities, techniques such as adversarial training or input preprocessing can be used [76].”
Self-Supervised Speech Quality Estimation and Enhancement Using Only Clean Speech
Fu, S.-W., Hung, K.-H., Tsao, Y., & Wang, Y.-C. F. (2024) · International Conference on Learning Representations · doi:10.48550/arxiv.2402.16321 · Cited by 33
“Step 2-1 (Adversarial attack) : To further improve the robustness of the student model, its encoder and decoder are fine-tuned by adversarial training (AT) (Goodfellow et al., 2014; Bai et al., 2021) with its codebook being fixed.”
BackgroundDefense Against Adversarial Attacks on Audio DeepFake Detection
Kawa, P., Plata, M., & Syga, P. (2022) · Interspeech · doi:10.48550/arxiv.2212.14597 · Cited by 33
“Answering to the described problem, as well as other common problems associated with adversarial training, such as generalization and (catastrophic) overfitting [20], we propose a new variant of adaptive training approach, in which we continuously analyze which attack is difficult to detect.”
BackgroundMethodBlackbox Attacks via Surrogate Ensemble Search
Cai, Z., Song, C., Krishnamurthy, S., Roy-Chowdhury, A., & Asif, M. S. (2022) · Neural Information Processing Systems · doi:10.48550/arxiv.2208.03610 · Cited by 33
“Many methods have been proposed in recent years to generate adversarial attacks [2, 5–11] (or to defend against such attacks [6, 12–20]).”
BackgroundTowards a Better Understanding of Evaluating Trustworthiness in AI Systems
Kemmerzell, N., Schreiner, A., Khalid, H., Schalk, M., & Bordoli, L. (2025) · ACM Computing Surveys · doi:10.1145/3721976 · Cited by 34
Xing, S., Zhao, Z., & Sebe, N. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.01413 · Cited by 14
“The first type is based on adversarial training [3, 58], which alter-nately generates adversarial images on one dataset and uses them to finetune the vision encoder of CLIP [32, 50].”
West, M. T., Nakhl, A. C., Heredge, J., Creevey, F. M., Hollenberg, L. C. L., Sevior, M. E., & Usman, M. (2024) · Intelligent Computing · doi:10.34133/icomputing.0100 · Cited by 38
“Indeed, an unexpected discovery of recent years has been the extreme susceptibility of artificial neural networks to careful tampering with their inputs (an “adversarial attack”), which can cause dramatic failures even in sophisticated high-performance models [29, 36, 52–60].”
BackgroundHybrid Deep Learning Model using SPCAGAN Augmentation for Insider Threat AnalysisPreprint
Gayathri, R. G., Sajjanhar, A., & Xiang, Y. (2022) · Expert systems with applications · doi:10.48550/arxiv.2203.02855 · Cited by 31
Yan, G.-L., Fu, X., Wang, Y., Zhang, Q.-Y., & Gui, G. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01902-9 · Cited by 30
Energy-Efficient Resource Allocation in Generative AI-Aided Secure Semantic Mobile Networks
Zheng, J., Du, B., Du, H., Kang, J., Niyato, D. T., & Zhang, H. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3396860 · Cited by 36
“This technique enhances models by training them with adversarial examples, as detailed in [21].”
MethodCoupling parameter and particle dynamics for adaptive sampling in Neural Galerkin schemes
Wen, Y., Vanden-Eijnden, E., & Peherstorfer, B. (2023) · Physica A: Statistical Mechanics and its Applications · doi:10.48550/arxiv.2306.15630 · Cited by 30
Semi-supervised Semantics-guided Adversarial Training for Robust Trajectory Prediction
Jiao, R.-C., Liu, X., Sato, T., Chen, Q. A., & Zhu, Q. (2022) · IEEE International Conference on Computer Vision · doi:10.1109/iccv51070.2023.00754 · Cited by 30
Zero-Query Transfer Attacks on Context-Aware Object Detectors
Cai, Z., Rane, S. D., Brito, A. E., Song, C., Krishnamurthy, S. V., Roy–Chowdhury, A. K., & Asif, M. S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01460 · Cited by 23
“Some representative defense mechanisms [43] for mitigating adversarial attacks include enhancing adversarial robustness of the model intrinsically through adversarial training [1,35,51] or strengthening model architectures [31,58]; and destroy adversary externally through input transformation [21, 56] or denoising [36…”
BackgroundResponsible cognitive digital clones as decision-makers: a design science research study
Golovianko, M., Gryshko, S., Terziyan, V. Y., & Tuunanen, T. (2022) · European Journal of Information Systems · doi:10.1080/0960085x.2022.2073278 · Cited by 43
“This type of learning is based on adversarial ML (Bai et al., 2021; Kumar et al., 2020; Kurakin et al., 2016), in which situations with maximum ignorance and uncertainty are generated and addressed synchronously by humans and clones.”
BackgroundART-Point: Improving Rotation Robustness of Point Cloud Classifiers via Adversarial Rotation
Wang, R., Yang, Y., & Tao, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01397 · Cited by 23
“Unlike other defense strategies, adversarial training aims to enhance the robustness of models intrinsically [1].”
BackgroundRequirements for Trustworthy Artificial Intelligence and its Application in Healthcare
Kim, M., Sohn, H., Choi, S. K., & Kim, S. (2023) · Healthcare Informatics Research · doi:10.4258/hir.2023.29.4.315 · Cited by 33
“In that case, there is a high probability that data will be stolen in one fell swoop if exposed to a person or group who intends malicious use, such as a hacker.”
BackgroundTowards Viewpoint-Invariant Visual Recognition via Adversarial Training
Ruan, S., Dong, Y., Su, H., Peng, J., Chen, N., & Wei, X. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00434 · Cited by 23
“[18] and is widely recognized as the most effective way to enhance the robustness of deep learning models [3, 4].”
BackgroundInvariant Policy Learning: A Causal Perspective
Saengkyongam, S., Thams, N., Peters, J., & Pfister, N. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3232363 · Cited by 15
“The idea of optimizing worst-case performance has been suggested in the reinforcement learning literature [1], [20] to ensure safe behavior of an agent and prevent catastrophic events and has also been used to formulate adversarial training [4] as well as out-ofdistribution generalization [73].”
BackgroundKhatun, A., & Usman, M. (2024) · Advanced Quantum Technologies · doi:10.1002/qute.202400268 · Cited by 31
Ravindran, A. (2023) · IoT · doi:10.3390/iot4040021 · Cited by 34
“Proposed defenses against these attacks require model robustification [120], input modification for removing perturbations [121], and adding external detectors to the model [122].”
PANACEA: A Neural Model Ensemble for Cyber-Threat Detection
Al-Essa, M., Andresini, G., Appice, A., & Malerba, D. (2023) · International Conference on Data Science and Advanced Analytics · doi:10.1007/s10994-023-06470-2 · Cited by 27
“In addition, we explore the performance of PANACEA with 𝜖 = 0.2 , although the study of Bai et al. (2021) suggested the generation of adversarial samples with small perturbations obtained with 𝜖 ≤ 0.1 .”
InfluentialAn XAI-based adversarial training approach for cyber-threat detection
AL-Essa, M., Andresini, G., Appice, A., & Malerba, D. (2022) · IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/dasc/picom/cbdcom/cy55231.2022.9927842 · Cited by 22
Learning to Fool the Speaker Recognition
Li, J., Zhang, X.-F., Xu, J.-Z., Zhang, L., Wang, Y., Ma, S.-W., & Gao, W. (2020) · IEEE International Conference on Acoustics, Speech, and Signal Processing · doi:10.1109/icassp40776.2020.9053058 · Cited by 27
“24 KS5 [1, 1, 1, 1, 1] [5] × 5 [32] × 5 98.”
MethodFu, Y., Liu, Z., & Lyu, J. (2024) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2024.3443403 · Cited by 31
“Adversarial training [38] includes adversarial examples into the training process, thereby making the model resistant to attacks.”
BackgroundCracking SQL Barriers: An LLM-based Dialect Translation System
Zhou, W., Gao, Y., Zhou, X., & Li, G. (2025) · Proceedings of the ACM on Management of Data · doi:10.1145/3725278 · Cited by 21
An Approach for EEG Denoising Based on Wasserstein Generative Adversarial Network
Dong, Y., Tang, X., Li, Q., Wang, Y., Jiang, N., Tian, L., Zheng, Y., Li, X., Zhao, S., Li, G., et al. (2023) · IEEE Transactions on Neural Systems and Rehabilitation Engineering · doi:10.1109/tnsre.2023.3309815 · Cited by 34
“Adversarial training [37] can solve this problem by enhancing the robustness of the model intrinsically, and Generative Adversarial Network (GAN) is one of the most represen-”
BackgroundImproving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing
Bai, Y., Anderson, B., Kim, A., & Sojoudi, S. (2023) · SIAM Journal on Mathematics of Data Science · doi:10.48550/arxiv.2301.12554 · Cited by 26
“Moreover, standard non-robust models often achieve enormous performance gains by pre-training on larger datasets with self-or semi-supervision [42, 15].”
BackgroundELAT: Ensemble Learning with Adversarial Training in defending against evaded intrusions
Lin, Y., Pratama, J.-H., Sudyana, D., Lai, Y., Hwang, R., Lin, P., Lin, H., Lee, W., & Chiang, C.-K. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103348 · Cited by 16
“In adversarial training, the model is trained with adversarial samples, so that it is smart enough to detect adversarial attacks injected into a dataset [6].”
BackgroundWhy adversarial training can hurt robust accuracyPreprint
Clarysse, J., Hörrmann, J., & Yang, F. (2022) · International Conference on Learning Representations · doi:10.48550/arxiv.2203.02006 · Cited by 26
“In the literature so far, it is widely acknowledged that adversarial training with the same perturbation type and budget as during test time often achieves significantly lower adversarial error than standard training (Madry et al., 2018; Zhang et al., 2019; Bai et al., 2021).”
BackgroundZhao, X., Huang, W., Banks, A., Cox, V. A., Flynn, D., Schewe, S., & Huang, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.01258 · Cited by 13
“As described in [Zhao et al. , 2021], we plan to investigate DL de-bug testing (e.g. [Huang et al. , 2021]) and retraining methods [Bai et al. , 2021], together with the RAM, to form a closed loop of debugging-improving-assessing.”
MethodOn the Importance of Backbone to the Adversarial Robustness of Object Detectors
Li, X., Chen, H., & Hu, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3542964 · Cited by 18
“Adversarial training and its variants [37, 45, 3] are generally recognized as the most effective defense methods against adversarial examples, which improve adversarial robustness of classifiers by incorporating adversarial examples into training:”
Hu, C.-H., Shi, W.-W., Jiang, T.-S., Yao, W., Tian, L., & Chen, X.-Q. (2023) · doi:10.48550/arxiv.2304.10712 · Cited by 24
“Adversarial training [49] is a common and effective defense technique that fundamentally enhances the model’s resistance to adversarial attacks.”
BackgroundDo Perceptually Aligned Gradients Imply Robustness?
Ganz, R., Kawar, B., & Elad, M. (2022) · International Conference on Machine Learning · doi:10.48550/arxiv.2207.11378 · Cited by 24
“This limitation was listed by (Hendrycks et al., 2021; Bai et al., 2021) as one of the major unsolved problems of adversarial training methods.”
BackgroundAcharya, K., & Song, H. (2025) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-025-10887-3 · Cited by 27
“Adversarial robustness [35] focuses on worst case, human orchestrated perturbations crafted explicitly to induce misclassification, while non-adversarial robustness [36] evaluates resilience to random noise sources such as Gaussian blur, sensor noise, or missing pixels that are not chosen by an…”
Ling, X., Wu, Z.-Y., Wang, B., Deng, W., Wu, J.-Z., Ji, S.-L., Luo, T.-Y., & Wu, Y.-J. (2024) · USENIX Security Symposium · doi:10.48550/arxiv.2407.02886 · Cited by 23
“(1) Adversarial training : Adversarial training is recognized as one of the most effective defenses against adversarial attacks [9].”
BackgroundImproving the Robustness of Transformer-based Large Language Models with Dynamic Attention
Shen, L., Pu, Y., Ji, S., Li, C., Zhang, X., Ge, C., & Wang, T. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24115 · Cited by 16
“Moreover, to obtain knowledge from adversarial examples, it is usually necessary to update all model parameters [48], which may reduce the model’s generalization ability [47], [2], [7].”
BackgroundRegularization properties of adversarially-trained linear regression
Ribeiro, A. H., Zachariah, D., Bach, F. R., & Schön, T. B. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2310.10807 · Cited by 23
“Adversarial training [7] is one of the most effective approaches for deep learning models to defend against adversarial attacks [7]–[9].”
BackgroundConceptualizing the Secure Machine Learning Operations (SecMLOps) Paradigm
Zhang, X., & Jaskolka, J. (2022) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs57517.2022.00023 · Cited by 30
“Data scientists specialized in security or the internal security experts have the knowledge of adversarial ML and various training techniques [31], [32].”
BackgroundLying with Truths: Open-Channel Multi-Agent Collusion for Belief Manipulation via Generative Montage
Hu, J., Huang, X., Sun, Y., Dong, Y., & Huang, X. (2026) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2026.acl-long.270 · Cited by 12
“At the training level, adversarial robustness techniques could expose agents to edited sequences during fine-tuning (Bai et al., 2021; Hu et al., 2025d) to resist strategic evidence curation, while machine unlearning could erase internalized false beliefs or prune vulnerable reasoning patterns (Liu…”
Enhancing CLIP Robustness via Cross-Modality Alignment
Zhu, X.-Y., Zhu, B.-E., Wang, S., Zhao, K., & Zhang, H.-W. (2025) · Neural Information Processing Systems · doi:10.48550/arxiv.2510.24038 · Cited by 22
Adversarial Attacks and Defense Technologies on Autonomous Vehicles: A Review
Mahima, K. T. Y., Ayoob, M., & Poravi, G. (2021) · Applied Computer Systems · doi:10.2478/acss-2021-0012 · Cited by 22
Universal Adversarial Attacks on Neural Networks for Power Allocation in a Massive MIMO System
Santos, P. M., Manoj, B., Sadeghi, M., & Larsson, E. G. (2021) · IEEE Wireless Communications Letters · doi:10.1109/lwc.2021.3120290 · Cited by 22
Hu, C.-H., Shi, W.-W., Jiang, T.-S., Yao, W., Tian, L., Chen, X.-Q., Zhou, J.-Z., & Li, W. (2024) · Neural Networks · doi:10.1016/j.neunet.2024.106310 · Cited by 21
Recent Advances in Neural Text Generation: A Task-Agnostic SurveyPreprint
Tang, C., Guerin, F., Li, Y., & Lin, C.-H. (2022) · arXiv.org · doi:10.48550/arxiv.2203.03047 · Cited by 21
“Adversarial Training is a kind of data augmentation strategy, which learns from adversarial samples, and improves the performance and robustness of neural models (Jiang et al., 2020; Bai et al., 2021).”
BackgroundDetecting Adversarial Perturbations in Multi-Task Perception
Klingner, M., Kumar, V. R., Yogamani, S. K., Bär, A., & Fingscheidt, T. (2022) · IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) · doi:10.1109/iros47612.2022.9981559 · Cited by 19
“Still, all perturbations are reliably detected for (cid:15) ≥ 8 , while smaller perturbations could potentially be defended by more robust training methods [39].”
CamoPatch: An Evolutionary Strategy for Generating Camoflauged Adversarial Patches
Li, K., & Williams, P. (2023) · Advances in Neural Information Processing Systems 36 · doi:10.52202/075280-2939 · Cited by 21
“As a result, developing methods to generate adversarial images has emerged as a critical research area for assessing the robustness of DNNs [3].”
Method
Metadata
- Authors
- Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q.
- Affiliations
- Nanyang Technological University (SG)
- Wuhan University (CN)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2021
- Pages
- 4312-4321
- arXiv
- 2102.01356
- OpenAlex
- W3191453585
- Cited by
- 490
- References
- 130
- Citations by year
- 2026: 56 · 2025: 116 · 2024: 144 · 2023: 108 · 2022: 49 · 2021: 17
- FWCI
- 36.73
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Research Foundation
- National Natural Science Foundation of China (U20B2049, 61822207)
- Ministry of Education, India
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- adversarial training, adversarial robustness, adversarial examples
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
