Research map / Adversarial robustness and security / Attacks on text and graphs
Attacks and defenses in sequential settings
Study adversarial attacks on RL, online learners and foundation models.
96 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Attacks on text and graphs, keyword cluster “generative · purification · diffusion”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
31 papers in 2023–24 and 31 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 11.1% to 6.4%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · A Security Game Combining Patrolling and Alarm-Triggered Responses Under Spatial and Detection Uncertainties (AAAI 2016 · 15 citations)
- 2017 · Minimizing Trust Leaks for Robust Sybil Detection (ICML 2017 · 10 citations)
- 2018 · Online Robust Policy Learning in the Presence of Unknown Adversaries (NeurIPS 2018 · 23 citations)
- 2019 · One-Class Adversarial Nets for Fraud Detection (AAAI 2019 · 154 citations)
- 2020 · TBT: Targeted Neural Network Attack With Bit Trojan (CVPR 2020 · 195 citations)
- 2021 · Learning from History for Byzantine Robust Optimization (ICML 2021 · 55 citations)
- 2022 · Fairness-Aware Adversarial Perturbation Towards Bias Mitigation for Deployed Deep Models (CVPR 2022 · 53 citations)
- 2023 · Adversarial Policies Beat Superhuman Go AIs (ICML 2023 · 9 citations)
- 2024 · Optimal Attack and Defense for Reinforcement Learning (AAAI 2024 · 9 citations)
- 2025 · RAT: Adversarial Attacks on Deep Reinforcement Agents for Targeted Behaviors (AAAI 2025 · 7 citations)
- 2026 · RSA-CR: Resisting Shilling Attacks in Citation Recommendation via Dumbbell Inductive Learning (AAAI 2026 · 1 citation)
Earliest papers here
- A Security Game Combining Patrolling and Alarm-Triggered Responses Under Spatial and Detection Uncertainties (AAAI 2016 · 15 citations)
- Minimizing Trust Leaks for Robust Sybil Detection (ICML 2017 · 10 citations)
- Online Robust Policy Learning in the Presence of Unknown Adversaries (NeurIPS 2018 · 23 citations)
What has been tried
69 papers here report 645 measured changes (a component added, removed or swapped, compared with a baseline): helped 59%, no clear effect 9%, hurt 24%, mixed 8%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add the intention policy πθ | Drawer Open, Drawer Close, Faucet Open, Faucet Close · attack success rate | Drawer Open: 21.7% -> 99.1%; Drawer Close: 8.0% -> 80.9%; Faucet Open: 0.0% -> 84.4%; Faucet Close: 13.0% -> 95.1% | Helped | RAT: Adversarial Attacks on Deep Reinforcement Agents for Targeted Behaviors (AAAI 2025 · 7 citations) |
| flip bits in scale factors rather than only weights | ImageNet, 4-bit, Deit-small · ASR (%) | 88.7 -> 98.2 | Helped | Your Scale Factors are My Weapon: Targeted Bit-Flip Attacks on Vision Transformers via Scale Factor Manipulation (CVPR 2025 · 4 citations) |
| Add stronger data augmentations with adversarial noises generated by a simple two-layer network | Region-16 and Err-min(S) · test accuracy | 77.20 -> 93.51; 75.62 -> 88.01 | Helped | Detection and Defense of Unlearnable Examples (AAAI 2024 · 4 citations) |
| Replace the surrogate attacker loss with cross-entropy loss | Training · poisoned loss convergence | Hurt | Game-Theoretic Unlearnable Example Generator (AAAI 2024 · 4 citations) | |
| Replace the mean of squared deviations with median absolute deviation (MAD) for estimating batch variance | TTA benchmark experiments · model performance | Hurt | MedBN: Robust Test-Time Adaptation against Malicious Test Samples (CVPR 2024 · 3 citations) | |
| Add gradient robust loss to MI-FGSM | Medical SAM (CT-Scans) · mDSC | 40.83 -> 6.34 | Helped | Transferable Adversarial Attacks on SAM and Its Downstream Models (NeurIPS 2024 · 3 citations) |
| Use BorderLIME instead of standard LIME | Neural Networks · Proof generation time | 1.17 ± 10^{-2} -> 4.85 ± 10^{-2} mins | Hurt | ExpProof : Operationalizing Explanations for Confidential Models with ZKPs (ICML 2025 · 1 citation) |
| Increase the augmentation strength in AUE generation | CIFAR-10, SimCLR · accuracy (%) | 83.5 -> 64.1 -> 56.7 -> 52.4 | Helped | Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously (NeurIPS 2024 · 1 citation) |
| Increase perturbation budget proportion | Ablation study · accuracy | Hurt | Stop Diverse OOD Attacks: Knowledge Ensemble for Reliable Defense (AAAI 2025 · 0 citations) | |
| add the self-supervised representation network | Pendulum · worst-case reward | -91.15 ± 58.15 -> -87.92 ± 53.24 | Helped | RobustZero: Enhancing MuZero Reinforcement Learning Robustness to State Perturbations (ICML 2025 · 0 citations) |
| Remove the instruction loss from RNP+A2I training | Beer-related datasets, sparsity about 20% · attack success rate | Mixed | Adversarial Cooperative Rationalization: The Risk of Spurious Correlations in Even Clean Datasets (ICML 2025 · 0 citations) | |
| Use PatternTraces alone instead of CombinedTraces | QUT-DV25 test · accuracy | 95.99 -> 94.62 | Hurt | QUT-DV25: A Dataset for Dynamic Analysis of Next-Gen Software Supply Chain Attacks (NeurIPS 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 14 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 2 of 14 papers
- ImageNet · 2 of 14 papers
Baselines
- ATLA-PPO · 2 of 14 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 62 papers; from OpenAlex and the papers' affiliations).
- Academy of Mathematics and Systems Science · 3 papers
- Tsinghua University · 3 papers
- University of Wisconsin - Madison · 2 papers
- University of Chinese Academy of Sciences · 2 papers
- University of Waterloo · 2 papers
- Peking University · 2 papers
- Shanghai Jiao Tong University · 2 papers
- University of Science and Technology of China · 2 papers
- Pohang University of Science and Technology · 2 papers
- Huazhong University of Science and Technology · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Defenses against universal perturbations (97 papers)
- Diffusion-based adversarial purification (78 papers)
- Graph neural network robustness (71 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Vision-language model robustness (96 papers)
- Biologically inspired robust vision (77 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
- Neural network watermarking (53 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).