Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial perturbations beyond images
Craft universal, video and physical-world adversarial examples and self-supervised defenses.
69 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Attacks on text and graphs, keyword cluster “physical · object · patches”
State History Tried Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
11 papers in 2023–24 and 7 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 3.9% to 1.4%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Robust Physical-World Attacks on Deep Learning Visual Classification (CVPR 2018 · 2,168 citations)
- 2019 · ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples (CVPR 2019 · 326 citations)
- 2020 · A Self-supervised Approach for Adversarial Robustness (CVPR 2020 · 289 citations)
- 2021 · Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World (CVPR 2021 · 202 citations)
- 2022 · Frequency-Driven Imperceptible Adversarial Attack on Semantic Similarity (CVPR 2022 · 143 citations)
- 2023 · Imperceptible Adversarial Attack via Invertible Neural Networks (AAAI 2023 · 34 citations)
- 2024 · Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training (CVPR 2024 · 8 citations)
- 2025 · Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · 3 citations)
- 2026 · Concept-based Adversarial Attack: a Probabilistic Perspective (ICLR 2026 · 0 citations)
Earliest papers here
- Robust Physical-World Attacks on Deep Learning Visual Classification (CVPR 2018 · 2,168 citations)
- Synthesizing Robust Adversarial Examples (ICML 2018 · 667 citations)
- Generative Adversarial Perturbations (CVPR 2018 · 375 citations)
What has been tried
61 papers here report 618 measured changes (a component added, removed or swapped, compared with a baseline): helped 65%, no clear effect 7%, hurt 24%, mixed 4%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Use hard rather than soft masked smoothness | ImageNet non-targeted black-box attack, ℓ∞=10 and ℓ∞=255 · Averagebb ASR (%) | 47.95 vs 45.23; 67.20 vs 65.39 | Mixed | Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training (CVPR 2024 · 8 citations) |
| increase ϵ from 8 to 16 | DA-T · ASR | 6.0 % -> 100.0 % | Helped | NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack (AAAI 2024 · 5 citations) |
| include task loss to preserve classification accuracy during the compute attack | ImageNet-1K val, ViT-Tiny · Top-1 accuracy | 4.7% -> 68.5% | Helped | SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers (CVPR 2024 · 2 citations) |
| Use a larger perturbation constraint than 4/255 | MS-COCO · ASR | Helped | AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents (NeurIPS 2025 · 0 citations) | |
| Set λ to 0 rather than the accuracy-preserving value | ImageNet-1K validation · accuracy | ∼20% | Hurt | DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms (NeurIPS 2024 · 0 citations) |
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 18 papers; from OpenAlex and the papers' affiliations).
- Huazhong University of Science and Technology · 2 papers
- Fudan University · 2 papers
Use it
Download BibTeX of 32 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Biologically inspired robust vision (77 papers)
- Physical adversarial patches and camouflage (56 papers)
- Latency and driving-perception attacks (25 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).