The DOI matches its DataCite record; 101 of the 130 references it cites were found in a registry or an index.
Recent Advances in Adversarial Training for Adversarial Robustness
Open accessAbstract
Adversarial training is one of the most effective approaches defending against adversarial examples for deep learning models. Unlike other defense strategies, adversarial training aims to promote the robustness of models intrinsically. During the last few years, adversarial training has been studied and discussed from various aspects. A variety of improvements and developments of adversarial training are proposed, which were, however, neglected in existing surveys. For the first time in this survey, we systematically review the recent progress on adversarial training for adversarial robustness with a novel taxonomy. Then we discuss the generalization problems in adversarial training from three perspectives. Finally, we highlight the challenges which are not fully tackled and present potential future directions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial training [201] is widely adopted to improve model robustness against adversarial attacks by incorporating adversarial examples into the training process.”
From Deepfake detection across image, video, and audio: a comprehensive survey with empirical evaluation of generalization and robustness (2026) · cites this paper as [201]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Marsden, W. (2012) · doi:10.1017/cbo9781139207249.009 · Cited by 170,911 · cited 5×
“Su et al. (2018) evaluated the recent SOTA ImageNet-based DNN models on multiple robustness metrics.”
MethodResultInfluentialRosenbloom, L. (2019) · Charleston Advisor · doi:10.5260/chara.21.2.8 · Cited by 16,663 · cited 4×
“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al.”
MethodResultInfluentialExplaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · cited 15×
“The adversarial counterpart x ′ of x is expressed as There are some common attacks following this formulation like Fast Gradient Sign Method (FGSM) [Goodfellow et al. , 2015], iterative FGSM [Kurakin et al. , 2016], and Projected Gradient Descent (PGD) attack [Madry et al. , 2018].”
BackgroundMethodInfluentialIntriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · cited 12×
“Current adversarial training methods [Madry et al. , 2018] can produce a robust model with worst-case accuracy of around 90% on MNIST.”
BackgroundMethodInfluentialmixup: Beyond Empirical Risk Minimization
Zhang, H., Cisse, M., Dauphin, Y. N., & Lopez-Paz, D. (2017) · arXiv · doi:10.48550/arxiv.1710.09412 · Cited by 5,831 · cited 1×
“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al., 2018] and early stopping, where early stopping is found to be the most effective.”
MethodAdversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · cited 2×
“, 2015], iterative FGSM [Kurakin et al., 2016], and Projected Gradient Descent (PGD) attack [Madry et al.”
BackgroundMethodPractical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495
Improved regularization of convolutional neural networks with cutout
DeVries, T., & Taylor, G. W. (2017) · arXiv · doi:10.48550/arxiv.1708.04552 · Cited by 2,776 · cited 1×
“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al.”
MethodAdversarial machine learning at scale
Kurakin, A., Goodfellow, I., & Bengio, S. (2016) · arXiv · doi:10.48550/arxiv.1611.01236 · Cited by 2,325 · cited 1×
“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”
BackgroundEnsemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176
Recognizing linked events: Searching the space of feasible explanations
Damen, D., & Hogg, D. C. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206636 · Cited by 2,111 · cited 4×
“The shreds of evidence in [Yang et al., 2020b; Stutz et al., 2019] show that adversarial training might not be the optimal solution for obtaining models with desirable robustness and accuracy.”
BackgroundInfluentialThreat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
Akhtar, N., & Mian, A. (2018) · IEEE Access · doi:10.1109/access.2018.2807385 · Cited by 2,021 · cited 1×
“To our best knowledge, surveys focusing on adversarial training do not exist, as recently proposed surveys [Akhtar and Mian, 2018; Wiyatno et al., 2019] aim at summarizing existing adversarial attacks and defense methods.”
BackgroundAdversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733 · cited 2×
“Toour best knowledge, surveys focusing on adversarial training do not exist so far, and recently proposed surveys [Yuan et al. , 2019; Silva and Najafirad, 2020] mainly summarize existing adversarial attacks and defense methods.”
BackgroundMethodTheoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019) · arXiv · doi:10.48550/arxiv.1901.08573 · Cited by 1,560
Adversarial Training for Free!
Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J. P., Studer, C., Davis, L., Taylor, G., & Goldstein, T. (2019) · Neural Information Processing Systems · doi:10.48550/arxiv.1904.12843 · Cited by 1,514 · cited 3×
“One well-known limitation of conventional adversarial training methods like PGD-AT is that they take 3-30 times longer than standard training before the model converges [Shafahi et al. , 2019].”
BackgroundMethodRobustness May Be at Odds with AccuracyPreprint
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12152 · Cited by 1,513 · cited 1×
“Tsipras et al. (2018) claimed that standard accuracy and adversarial robustness might at odds and demonstrated the existence of the trade-off via a binary classification task.”
BackgroundAudio Adversarial Examples: Targeted Attacks on Speech-to-Text
Carlini, N., & Wagner, D. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00009 · Cited by 1,157
Countering Adversarial Images using Input TransformationsPreprint
Guo, C., Rana, M., Cissé, M., & van der Maaten, L. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.00117 · Cited by 1,151
Dalvi, N. N., Domingos, P. M., Mausam, Sanghai, S. K., & Verma, D. (2004) · Knowledge Discovery and Data Mining · doi:10.1145/1014052.1014066 · Cited by 1,085 · cited 1×
“The initial idea of adversarial training is firstly brought to light by [Dalvi et al., 2004; Lowd and Meek, 2005] in a game-theoretic setup.”
BackgroundAdversarial Examples for Semantic Segmentation and Object Detection
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.153 · Cited by 993
Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser
Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., & Zhu, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00191 · Cited by 987
Adversarial Examples Are Not Bugs, They Are Features
Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., & Madry, A. (2019) · arXiv · doi:10.48550/arxiv.1905.02175 · Cited by 971 · cited 1×
“…and Qureshi, 2019] (input gradients refer to the gradients of the loss function w.r.t. the input); and maximizing the vulnerability diversity [Yang et al. , 2020a], which is defined as the sum of losses for two models with crafted images containing non-robust features [Ilyas et al. , 2019].”
BackgroundFast is better than free: Revisiting adversarial trainingPreprint
Wong, E., Rice, L., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.03994 · Cited by 947
Adversarial Attacks on Neural Network PoliciesPreprint
Huang, S., Papernot, N., Goodfellow, I., Duan, Y., & Abbeel, P. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.02284 · Cited by 915
Generating Natural Language Adversarial Examples
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M. B., & Chang, K.-W. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1316 · Cited by 895
Adversarially Robust Generalization Requires More DataPreprint
Schmidt, L., Santurkar, S., Tsipras, D., Talwar, K., & Ma̧dry, A. (2018) · Neural Information Processing Systems · doi:10.48550/arxiv.1804.11285 · Cited by 891
Identifying and attacking the saddle point problem in high-dimensional non-convex optimization
Dauphin, Y., Pascanu, R., Gulcehre, C., Cho, K., Ganguli, S., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1406.2572 · Cited by 827
Lowd, D., & Meek, C. (2005) · Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining · doi:10.1145/1081870.1081950 · Cited by 755 · cited 1×
“The initial idea of adversarial training is firstly brought to light by [Dalvi et al., 2004; Lowd and Meek, 2005] in a game-theoretic setup.”
BackgroundAdversarial Logit PairingPreprint
Boyle, E., Kurakin, A., & Vaikuntanathan, V. (2018) · arXiv (Cornell University) · doi:10.4230/lipics.itcs.2019.16 · Cited by 669 · cited 2×
“[Kannan et al., 2018] proposed Adversarial Logit Pairing (ALP), a regularization method taking effects on logits.”
BackgroundMethodRoss, A. S., & Doshi‐Velez, F. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11504 · Cited by 647
Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty
Hendrycks, D., Mazeika, M., Kadavath, S., & Song, D. (2019) · arXiv · doi:10.48550/arxiv.1906.12340 · Cited by 634
Generalizing to Unseen Domains via Adversarial Data AugmentationPreprint
Volpi, R., Namkoong, H., Şener, O., Duchi, J. C., Murino, V., & Savarese, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12018 · Cited by 594
Adversarial Attack on Graph Structured DataPreprint
Dai, H., Li, H., Tian, T., Huang, X. S., Wang, L., Zhu, J., & Song, L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.02371 · Cited by 593
The Space of Transferable Adversarial ExamplesPreprint
Tramèr, F., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. D. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1704.03453 · Cited by 589 · cited 1×
“, 2014] and share the adversarial subspace [Tramèr et al., 2017], which potentially hurts the”
BackgroundUsing Pre-Training Can Improve Model Robustness and UncertaintyPreprint
Hendrycks, D., Lee, K., & Mazeika, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09960 · Cited by 553
Overfitting in adversarially robust deep learningPreprint
Rice, L., Wong, E., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11569 · Cited by 491 · cited 3×
“Other than CIFAR-10, similar experimental results are observed on multiple datasets, such as SVHN, CIFAR-100, and ImageNet [Rice et al. , 2020].”
BackgroundResultLearning to Learn Single Domain Generalization
Qiao, F., Zhao, L., & Peng, X. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01257 · Cited by 488
Unlabeled Data Improves Adversarial RobustnessPreprint
Carmon, Y., Raghunathan, A., Schmidt, L., Liang, P., & Duchi, J. C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.13736 · Cited by 440 · cited 2×
“From the perspective of generalization, the theory of sample complexity [Schmidt et al. , 2018] explains such a phenomenon partially, and is supported by experimental results in derivative works [Alayrac et al. , 2019; Carmon et al. , 2019].”
MethodResultSu, D., Zhang, H., Chen, H., Yi, J., Chen, P., & Gao, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01258-8_39 · Cited by 353
Learning with a Strong AdversaryPreprint
Huang, R., Xu, B. H., Schuurmans, D., & Szepesvári, C. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1511.03034 · Cited by 335 · cited 4×
“The existence of adversarial examples raises concerns from the public and motivates the proposals of defenses [Goodfellow et al. , 2015; Huang et al. , 2015; Madry et al. , 2018].”
BackgroundInfluentialTowards the first adversarially robust neural network model on MNISTPreprint
Schott, L., Rauber, J., Bethge, M., & Brendel, W. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.09190 · Cited by 310 · cited 1×
“…various defense strategies, Adversarial Training (AT) [Goodfellow et al. , 2015; Madry et al. , 2018] currently proves to be the most effective against adversarial attacks [Pang et al. , 2020a; Maini et al. , 2020; Schott et al. , 2019], receiving considerable attention from the research community.”
BackgroundImproving Adversarial Robustness via Promoting Ensemble DiversityPreprint
Pang, T., Xu, K., Du, C., Chen, N., & Zhu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.08846 · Cited by 300
Robust Deep Reinforcement Learning with Adversarial Attacks
Pattanaik, A., Tang, Z., Liu, S., Bommannan, G., & Chowdhary, G. V. (2018) · Adaptive Agents and Multi-Agents Systems · doi:10.65109/rnct3583 · Cited by 297 · cited 1×
“, 2019], audios [Pandey and Wang, 2018], and reinforcement learning [Pattanaik et al., 2017].”
BackgroundTransferable Adversarial Attacks for Image and Video Object Detection
Wei, X., Liang, S., Chen, N., & Cao, X. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/134 · Cited by 274
Attacks Which Do Not Kill Training Make Adversarial Learning StrongerPreprint
Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M., & Kankanhalli, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11242 · Cited by 267
On the Convergence and Robustness of Adversarial TrainingPreprint
Wang, Y., Ma, X., Bailey, J., Yi, J., Zhou, B., & Gu, Q. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2112.08304 · Cited by 252
Robustness via Curvature Regularization, and Vice Versa
Moosavi-Dezfooli, S.-M., Fawzi, A., Uesato, J., & Frossard, P. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00929 · Cited by 245
You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
Zhang, D., Zhang, T., Lu, Y., Zhu, Z., & Dong, B. (2019) · ePrints Soton (University of Southampton) · doi:10.48550/arxiv.1905.00877 · Cited by 233
Disentangling Adversarial Robustness and Generalization
Stutz, D., Hein, M., & Schiele, B. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00714 · Cited by 223 · cited 2×
“The shreds of evidence in [Yang et al. , 2020b; Stutz et al. , 2019] show that adversarial training might not be the optimal solution for obtaining models with desirable robustness and accuracy.”
BackgroundResultThe Relaxed Online Maximum Margin Algorithm
Li, Y., & Long, P. M. (2002) · Machine Learning · doi:10.1023/a:1012435301888 · Cited by 220 · cited 5×
“2, a series of methods [Alayrac et al., 2019; Carmon et al., 2019] leverage semi/unsupervised learning on unlabeled data to enhance the generalization of adversarial training.”
BackgroundMethodResultInfluentialAdversarial Robustness through Local LinearizationPreprint
Qin, C., Martens, J., Gowal, S., Krishnan, D., Dvijotham, K., Fawzi, A., De, S., Stanforth, R., & Kohli, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.02610 · Cited by 218
Bag of Tricks for Adversarial TrainingPreprint
Pang, T., Yang, X. H., Dong, Y., Su, H., & Zhu, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.00467 · Cited by 217 · cited 7×
“Some replace the fundamental components of models for better performances, like hypersphere embedding [Pang et al. , 2020b], and smoothed ReLU function [Xie et al. , 2020].”
BackgroundMethodInfluentialAre Labels Required for Improving Adversarial Robustness?Preprint
Uesato, J., Alayrac, J.-B., Huang, P.-S., Stanforth, R., Fawzi, A., & Kohli, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.13725 · Cited by 207
MMA Training: Direct Input Space Margin Maximization through Adversarial TrainingPreprint
Ding, G. W., Sharma, Y., Lui, K. Y. C., & Huang, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.02637 · Cited by 199 · cited 5×
“28% [Ding et al., 2020] Wide ResNet PGD100 8/255 CIFAR-10 47.”
BackgroundMethodInfluentialAdversarial Examples Are a Natural Consequence of Test Error in NoisePreprint
Ford, N., Gilmer, J., Carlini, N., & Cubuk, E. D. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.10513 · Cited by 197
Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial TrainingPreprint
Zhang, H., & Wang, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.10764 · Cited by 196
Adversarial Training Can Hurt GeneralizationPreprint
Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., & Liang, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.06032 · Cited by 185 · cited 1×
“Experiments in [Raghunathan et al., 2019] support this statement, where additional unlabeled data is proved to help mitigate the tradeoff.”
Curriculum Adversarial Training
Cai, Q.-Z., Liu, C., & Song, D. X. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/520 · Cited by 185
Adversarial Examples in Modern Machine Learning: A ReviewPreprint
Wiyatno, R. R., Xu, A., Dia, O., & de Berker, A. O. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.05268 · Cited by 168 · cited 1×
“To our best knowledge, surveys focusing on adversarial training do not exist, as recently proposed surveys [Akhtar and Mian, 2018; Wiyatno et al., 2019] aim at summarizing existing adversarial attacks and defense methods.”
BackgroundOpportunities and Challenges in Deep Learning Adversarial Robustness: A SurveyPreprint
Silva, S. H., & Najafirad, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.00753 · Cited by 165 · cited 1×
“Toour best knowledge, surveys focusing on adversarial training do not exist so far, and recently proposed surveys [Yuan et al. , 2019; Silva and Najafirad, 2020] mainly summarize existing adversarial attacks and defense methods.”
BackgroundMetric Learning for Adversarial RobustnessPreprint
Mao, C., Zhong, Z., Yang, J., Vondrick, C., & Ray, B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.00900 · Cited by 157
Rademacher Complexity for Adversarially Robust GeneralizationPreprint
Yin, D., Ramchandran, K., & Bartlett, P. L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.11914 · Cited by 154
On the Robustness of the CVPR 2018 White-Box Adversarial Example DefensesPreprint
Athalye, A., & Carlini, N. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.03286 · Cited by 151 · cited 1×
“Adversarial training is widely accepted as the most effective method in practice to improve the adversarial robustness of deep learning models [Athalye and Carlini, 2018].”
MethodUnderstanding and Improving Fast Adversarial TrainingPreprint
Andriushchenko, M., & Flammarion, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.02617 · Cited by 146 · cited 3×
“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al. , 2019; Wong et al. , 2020] suffer from catastrophic overfitting like FGSM-AT.”
BackgroundAdversarial training and robustness for multiple perturbations
Tramèr, F., & Boneh, D. (2019) · arXiv · doi:10.48550/arxiv.1904.13000 · Cited by 145
Adversarial Self-Supervised Contrastive LearningPreprint
Kim, M., Tack, J., & Hwang, S. J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.07589 · Cited by 145 · cited 1×
“, 2020] where a distributionbased min-max problem is derived from a general view; bilateral adversarial training [Wang and Zhang, 2019] where the model is training on both perturbed images and labels; adversarial training based on feature scatter [Zhang and Wang, 2019], which utilizes a distance metric for sets of nat…”
BackgroundAdversarially Robust Generalization Just Requires More Unlabeled DataPreprint
Zhai, R., Cai, T., He, D., Chen, D., He, K., Hopcroft, J. E., & Wang, L. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.00555 · Cited by 144 · cited 3×
“Following the analysis of Gaussian models in [Schmidt et al. , 2018], a couple of works [Alayrac et al. , 2019; Carmon et al. , 2019; Zhai et al. , 2019] theoretically show that training with unlabeled data significantly reduces the sample complexity gap between standard training and robust training.”
BackgroundMethodRobustness to Adversarial Perturbations in Learning from Incomplete DataPreprint
Najafi, A., Maeda, S., Koyama, M., & Miyato, T. (2019) · Neural Information Processing Systems · doi:10.48550/arxiv.1905.13021 · Cited by 140
Robust Pre-Training by Adversarial Contrastive LearningPreprint
Jiang, Z., Chen, T., Chen, T., & Wang, Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.13337 · Cited by 132 · cited 1×
“, 2020] where a distributionbased min-max problem is derived from a general view; bilateral adversarial training [Wang and Zhang, 2019] where the model is training on both perturbed images and labels; adversarial training based on feature scatter [Zhang and Wang, 2019], which utilizes a distance metric for sets of nat…”
BackgroundNonconvex Min-Max Optimization: Applications, Challenges, and Recent Theoretical Advances
Razaviyayn, M., Huang, T., Lu, S., Nouiehed, M., Sanjabi, M., & Hong, M. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.3003851 · Cited by 131
Evaluating and Understanding the Robustness of Adversarial Logit PairingPreprint
Engstrom, L., Ilyas, A., & Athalye, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.10272 · Cited by 124 · cited 2×
“But ALP initially is not useful due to the wrong formulation of adversarial training objectives [Engstrom et al. , 2018].”
BackgroundImproving Adversarial Robustness of Ensembles with Diversity TrainingPreprint
Kariyappa, S., & Qureshi, M. K. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09981 · Cited by 123
Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization
Lee, S., Lee, H., & Yoon, S. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00035 · Cited by 121 · cited 1×
“Last, some propose to augment adversarial examples by interpolation, such as AVmixup [Lee et al. , 2020] and adversarial interpolation training [Zhang and Xu, 2020].”
BackgroundWang, J., & Zhang, H. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00673 · Cited by 118 · cited 6×
“Zhang et al. (2019b) decomposed the robust error as the sum of natural error and the boundary error and provided a tight upper bound for them, theoretically characterizing the trade-off.”
BackgroundMethodInfluentialInstance adaptive adversarial training: Improved accuracy tradeoffs in neural netsPreprint
Balaji, Y., Goldstein, T., & Hoffman, J. (2019) · arXiv.org · doi:10.48550/arxiv.1910.08051 · Cited by 116 · cited 3×
“Some works [Balaji et al., 2019; Ding et al., 2020] argued individual data points might have different intrinsic robustness, i.”
BackgroundSmooth Adversarial TrainingPreprint
Xie, C., Tan, M., Gong, B., Yuille, A., & Le, Q. V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.14536 · Cited by 113 · cited 2×
“Some replace the fundamental components of models for better performances, like hypersphere embedding [Pang et al. , 2020b], and smoothed ReLU function [Xie et al. , 2020].”
BackgroundMethodImproving the Generalization of Adversarial Training with Domain AdaptationPreprint
Song, C., He, K., Wang, L., & Hopcroft, J. E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.00740 · Cited by 111
Boosting Adversarial Training with Hypersphere EmbeddingPreprint
Pang, T., Yang, X. H., Dong, Y., Xu, K., Zhu, J., & Su, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.08619 · Cited by 104
A taxonomy and terminology of adversarial machine learningPreprint
Tabassi, E., Burns, K. J., Hadjimichael, M., Molina–Markham, A., & Sexton, J. T. (2019) · doi:10.6028/nist.ir.8269-draft · Cited by 103 · cited 1×
“Existing surveys are aimed at providing a complete review of adversarial machine learning and summarize all the existing adversarial attacks and defense methods [Yuan et al., 2019; Silva and Najafirad, 2020; Sadeghi et al., 2020; Tabassi et al., 2019; Smith, 2019], which inevitably omit important details of subfields.”
BackgroundCAT: Customized Adversarial Training for Improved Robustness
Cheng, M., Lei, Q., Chen, P., Dhillon, I. S., & Hsieh, C. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/95 · Cited by 101 · cited 3×
“The following work, Customized Adversarial Training (CAT) [Cheng et al. , 2020] further applies adaptive label uncertainty to prevent over-confident predictions based on adaptive ǫ .”
MethodInfluentialAdversarial Robustness Against the Union of Multiple Perturbation ModelsPreprint
Maini, P., Wong, E., & Kolter, J. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.04068 · Cited by 98
Understanding Catastrophic Overfitting in Single-step Adversarial Training
Kim, H., Lee, W., & Lee, J. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16989 · Cited by 97
Authors, V. (2018) · Journal of Music Theory Pedagogy · doi:10.71156/2994-7073.1198 · Cited by 93 · cited 1×
“Simply combining perturbations with different lp norms in adversarial training proves to be useless as well [Tramer and Boneh, 2019].”
A System-Driven Taxonomy of Attacks and Defenses in Adversarial Machine Learning
Sadeghi, K., Banerjee, A., & Gupta, S. K. S. (2020) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2020.2968933 · Cited by 87
Adversarial Distributional Training for Robust Deep LearningPreprint
Dong, Y., Deng, Z., Pang, T., Su, H., & Zhu, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.05999 · Cited by 85
On Adversarial Training and Loss Functions for Speech Enhancement
Pandey, A., & Wang, D.-L. (2018) · IEEE International Conference on Acoustics, Speech, and Signal Processing · doi:10.1109/icassp.2018.8462614 · Cited by 78
DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of EnsemblesPreprint
Yang, H., Zhang, J., Dong, H., Inkawhich, N., Gardner, A., Touchet, A., Wilkes, W., Berry, H., & Li, H. H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.14720 · Cited by 75
Evaluating Robustness of Deep Image Super-Resolution Against Adversarial Attacks
Choi, J. H., Zhang, H., Kim, J., Hsieh, C., & Lee, J. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00039 · Cited by 73
Robust Local Features for Improving the Generalization of Adversarial TrainingPreprint
Song, C., He, K., Lin, J., Wang, L., & Hopcroft, J. E. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.10147 · Cited by 68 · cited 4×
“Later many efforts are made to improve generalization empirically, such as adversarial training with semi/unsupervised Learning, AVmixup, and robust local feature [Song et al. , 2020].”
BackgroundInfluentialSingle-Step Adversarial Training With Dropout Scheduling
Vivek, B. S., & Babu, R. V. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00103 · Cited by 64 · cited 1×
“…of preventing catastrophic overfitting, many improvements are proposed like GradAlign [Andriushchenko and Flammarion, 2020], dynamic schedule [Vivek and Babu, 2020b], inner interval verification [Kim et al. , 2021], domain adaption [Song et al. , 2019] and regularization meth-ods [Vivek and…”
BackgroundLearning perturbation sets for robust machine learningPreprint
Wong, E., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.08450 · Cited by 52
Transfer of Adversarial Robustness Between Perturbation TypesPreprint
Kang, D. D., Sun, Y., Brown, T., Hendrycks, D., & Steinhardt, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.01034 · Cited by 46 · cited 3×
“, other lp norms, or larger ǫ, or different target models [Kang et al., 2019].”
BackgroundInfluentialTowards Understanding Fast Adversarial TrainingPreprint
Li, B., Wang, S., Jana, S., & Carin, L. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.03089 · Cited by 44
On the Generalization Properties of Adversarial TrainingPreprint
Xing, Y., Song, Q.-F., & Cheng, G. (2020) · International Conference on Artificial Intelligence and Statistics · doi:10.48550/arxiv.2008.06631 · Cited by 40 · cited 1×
“Some variants of adversarial training show better standard generalization empirically, such as adaptive ǫ for adversarial training reviewed in Section 3.2, robust local features [Song et al. , 2020] and L 1 penalty [Xing et al. , 2020].”
InfluentialPAC-learning in the presence of evasion adversariesPreprint
Cullina, D., Bhagoji, A. N., & Mittal, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.01471 · Cited by 34
Bridging the Performance Gap between FGSM and PGD Adversarial TrainingPreprint
Huang, T., Menkovski, V., Pei, Y., & Pechenizkiy, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.05157 · Cited by 26 · cited 3×
“, 2019] and regularization methods [Vivek and Babu, 2020; Huang et al., 2020].”
BackgroundMethodAttribute-Guided Adversarial Training for Robustness to Natural Perturbations
Gokhale, T., Anirudh, R., Kailkhura, B., Thiagarajan, J. J., Baral, C. R., & Yang, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16927 · Cited by 25 · cited 1×
“There are evidences that models trained on such common corruptions show robustness to adversarial examples [Gokhale et al., 2020; Wong and Kolter, 2021].”
BackgroundIEEE Transactions on Emerging Topics in Computational Intelligence
(2021) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2021.3049727 · Cited by 11 · cited 1×
“Existing surveys are aimed at providing a complete review of adversarial machine learning and summarize all the existing adversarial attacks and defense methods [Yuan et al., 2019; Silva and Najafirad, 2020; Sadeghi et al., 2020; Tabassi et al., 2019; Smith, 2019], which inevitably omit important details of subfields.”
BackgroundRegularizers for Single-step Adversarial TrainingPreprint
Vivek, B. S., & Babu, R. V. (2020) · arXiv.org · doi:10.48550/arxiv.2002.00614 · Cited by 7 · cited 1×
“…overfitting, many improvements are proposed like GradAlign [Andriushchenko and Flammarion, 2020], dynamic schedule [Vivek and Babu, 2020b], inner interval verification [Kim et al. , 2021], domain adaption [Song et al. , 2019] and regularization meth-ods [Vivek and Babu, 2020a; Huang et al. , 2020].”
BackgroundA Useful Taxonomy for Adversarial Robustness of Neural Networks
Smith, L. (2019) · Trends in Computer Science and Information Technology · doi:10.17352/tcsit.000017 · Cited by 6 · cited 1×
“Existing surveys are aimed at providing a complete review of adversarial machine learning and summarize all the existing adversarial attacks and defense methods [Yuan et al., 2019; Silva and Najafirad, 2020; Sadeghi et al., 2020; Tabassi et al., 2019; Smith, 2019], which inevitably omit important details of subfields.”
Background
Flagged first, then by citations
29 of the 130 references couldn’t be matched to a known paper.
Research works printed but not linked: 7
- Jacob Buckman, Aurko Roy, Colin Raffel, and Ian J. Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In Proc. of ICLR, 2018.
- Quanyu Dai, Xiao Shen, Liang Zhang, Qiang Li, and Dan Wang. Adversarial training methods for network embedding. In The World Wide Web Confer- ence, WWW 2019, San Francisco, CA, USA, May 13-17, 2019, pages 329-339, 2019.
- Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi- supervised text classification. In Proc. of ICLR, 2017.
- Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Ad- versarial training for free! In NeurIPS, pages 3353-3364, 2019.
- David Stutz, Matthias Hein, and Bernt Schiele. Confidence-calibrated adversarial training: Gen- eralizing to unseen attacks. In ICML, pages 9155-9166, 2020.
- Wang et al., 2020] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improv- ing adversarial robustness requires revisiting misclassified examples. In Proc. of ICLR, 2020.
- Yang et al., 2020b] Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems, 33, 2020.
Cited by
Sorted by citations
Unleashing the potential of prompt engineering for large language models
CHEN, B. ‐., Zhang, Z., Langrené, N., & Zhu, S. (2025) · Patterns · doi:10.1016/j.patter.2025.101260 · Cited by 1,097
Yenduri, G., Ramalingam, M., Selvi, G. C., Supriya, Y., Srivastava, G., Maddikunta, P. K. R., Raj, G. D., Jhaveri, R. H., Prabadevi, B., Wang, W., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3389497 · Cited by 916
A Survey on ChatGPT: AI–Generated Contents, Challenges, and Solutions
Wang, Y., Pan, Y., Yan, M., Su, Z., & Luan, T. H. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3300321 · Cited by 436
“Various techniques, such as robust optimization [115], adversarial training [114], and defensive distillation [116], can improve the adversarial robustness of AIGC systems.”
BackgroundThe neuroconnectionist research programme
Doerig, A., Sommers, R. P., Seeliger, K., Richards, B., Ismael, J., Lindsay, G. W., Kording, K. P., Konkle, T., van Gerven, M. A. J., Kriegeskorte, N., et al. (2023) · Nature Reviews Neuroscience · doi:10.1038/s41583-023-00705-w · Cited by 233
Applications of deep learning in precision weed management: A review
Rai, N., Zhang, Y., Ram, B. G., Schumacher, L., Yellavajjala, R. K., Bajwa, S., & Sun, X. (2023) · Computers and Electronics in Agriculture · doi:10.1016/j.compag.2023.107698 · Cited by 218
Metadata
- Authors
- Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q.
- Affiliations
- Nanyang Technological University (SG)
- Wuhan University (CN)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2021
- Pages
- 4312-4321
- arXiv
- 2102.01356
- OpenAlex
- W3191453585
- Cited by
- 490
- References
- 130
- Citations by year
- 2026: 56 · 2025: 116 · 2024: 144 · 2023: 108 · 2022: 49 · 2021: 17
- FWCI
- 36.73
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Research Foundation
- National Natural Science Foundation of China (U20B2049, 61822207)
- Ministry of Education, India
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- adversarial training, adversarial robustness, adversarial examples
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
