Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Examples Are Not Bugs, They Are Features
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train on inputs adversarially perturbed toward random target labels | Standard ResNet-50 · CIFAR-10 test set | accuracy: 95.3% -> 63.3% | Hurt |
| Train on inputs adversarially perturbed toward deterministic target labels | Standard ResNet-50 · CIFAR-10 test set | accuracy: 95.3% -> 43.7% | Hurt |
| Train on inputs adversarially perturbed toward random target labels | Standard ResNet-50 · ImageNet_R test set | accuracy: 96.6% -> 87.9% | Hurt |
| Train on inputs adversarially perturbed toward deterministic target labels | Standard ResNet-50 · ImageNet_R test set | accuracy: 96.6% -> 64.4% | Hurt |
| Train with adversarial training rather than standard training | ResNet-50 · CIFAR-10 test set, ε=0.25 | robust accuracy: 4.49% -> 82.48% | Helped |
| Train with adversarial training rather than standard training | ResNet-50 · CIFAR-10 test set | accuracy: 95.25 % -> 90.83% | Hurt |
| Restrict training data to features used by a robust model, then use standard ERM | ResNet-50 · CIFAR-10 test set, ε=0.25 | robust accuracy: 4.49% -> 48.20 % | Helped |
| Initialize construction of the non-robust dataset from noise instead of training images (ablation) | ERM trained on non-robust dataset · CIFAR-10 test set | accuracy: 87.68% -> 45.60% | Hurt |
| Initialize robust-dataset construction from noise rather than training images (ablation) | ERM trained on robust dataset · CIFAR-10 test set, ε=0.25 | robust accuracy: 48.20 % -> 48.27 % | No clear effect |
| Construct the perturbed relabeled datasets using a robust model rather than a standard model (ablation) | Standard classifier trained on Drand · CIFAR-10 test set | accuracy: 63.3% -> 25.2 % | Hurt |
| Construct the perturbed relabeled datasets using a robust model rather than a standard model (ablation) | Standard classifier trained on Ddet · CIFAR-10 test set | accuracy: 43.7% -> 5.8% | Hurt |
Closest papers by meaning
- Adversarial Examples Are Not Real Features (NeurIPS 2023 · similarity 0.93)
- Are adversarial examples inevitable? (ICLR 2019 · similarity 0.93)
- Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them (ICML 2022 · similarity 0.91)
- Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustness (NeurIPS 2023 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.90)
- Doppelgangers and Adversarial Vulnerability (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.