Research map / Adversarial robustness and security / Certified and empirical robustness
Towards Deep Learning Models Resistant to Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| train with multi-step PGD adversarial examples rather than natural examples (ablation) | Wide ResNet · CIFAR10 evaluation, white-box PGD, 20 steps, ε=8 | accuracy: 3.5% -> 45.8% | Helped |
| train with multi-step PGD adversarial examples rather than FGSM adversarial examples (ablation) | Wide ResNet · CIFAR10 evaluation, white-box PGD, 20 steps, ε=8 | accuracy: 0.0% -> 45.8% | Helped |
| increase model capacity from simple to wide (ablation) | PGD-trained ResNet · CIFAR10 evaluation, white-box PGD, 20 steps, ε=8 | accuracy: 43.7% -> 45.8% | Helped |
| train with PGD adversarial examples rather than natural examples (ablation) | Wide ResNet · CIFAR10 evaluation, clean | accuracy: 95.2% -> 87.3% | Hurt |
| train with FGSM adversarial examples rather than PGD adversarial examples (ablation) | Wide ResNet · CIFAR10 evaluation, clean | accuracy: 90.3% -> 87.3% | Helped |
| train with FGSM examples instead of PGD examples (ablation) | Wide ResNet · CIFAR10 evaluation, white-box FGSM, ε=8 | accuracy: 56.1% -> 95.1% | Helped |
| train with FGSM adversarial examples rather than PGD adversarial examples (ablation) | Wide ResNet · CIFAR10 evaluation, white-box PGD, 7 steps, ε=8 | accuracy: 50.0% -> 0.0% | Hurt |
| train against PGD adversaries instead of FGSM adversaries | adversarially trained models · MNIST, transfer attacks | accuracy | Helped |
| increase network capacity | adversarially trained models · CIFAR10, transfer attacks | transfer attack success | Helped |
| increase perturbation strength beyond the training ε | MNIST adversarially trained network · MNIST, ℓ∞ PGD attacks | accuracy | Hurt |
| use ℓ∞-trained model against ℓ₂ attacks rather than a standard model | MNIST model · MNIST, ℓ₂-bounded attacks | robustness | Helped |
Closest papers by meaning
- Accurate, reliable and fast robustness evaluation (NeurIPS 2019 · similarity 0.92)
- Convergence of Adversarial Training in Overparametrized Neural Networks (NeurIPS 2019 · similarity 0.92)
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · similarity 0.91)
- Robust Models are less Over-Confident (NeurIPS 2022 · similarity 0.91)
- Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks (NeurIPS 2021 · similarity 0.91)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.