Research map / Adversarial robustness and security / Attacks on text and graphs
Biologically inspired robust vision
Improve adversarial robustness with foveation, visual-cortex front-ends, nearest-neighbor defenses and unadversarial objects.
77 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Attacks on text and graphs, keyword cluster “physical · object · patches”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
23 papers in 2023–24 and 13 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 8.2% to 2.7%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Improving the Robustness of Deep Neural Networks via Stability Training (CVPR 2016 · 600 citations)
- 2017 · On Detecting Adversarial Perturbations (ICLR 2017 · 213 citations)
- 2018 · Crowd Counting via Adversarial Cross-Scale Consistency Pursuit (CVPR 2018 · 397 citations)
- 2019 · Non-Local Context Encoder: Robust Biomedical Image Segmentation against Adversarial Attacks (AAAI 2019 · 70 citations)
- 2020 · Towards Large Yet Imperceptible Adversarial Image Perturbations With Perceptual Color Distance (CVPR 2020 · 161 citations)
- 2021 · When Human Pose Estimation Meets Robustness: Adversarial Algorithms and Benchmarks (CVPR 2021 · 60 citations)
- 2022 · BppAttack: Stealthy and Efficient Trojan Attacks Against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learning (CVPR 2022 · 103 citations)
- 2023 · Evading DeepFake Detectors via Adversarial Statistical Consistency (CVPR 2023 · 67 citations)
- 2024 · RoDLA: Benchmarking the Robustness of Document Layout Analysis Models (CVPR 2024 · 14 citations)
- 2025 · A²RNet: Adversarial Attack Resilient Network for Robust Infrared and Visible Image Fusion (AAAI 2025 · 19 citations)
- 2026 · OTI: A Model-free and Visually Interpretable Measure of Image Attackability (AAAI 2026 · 0 citations)
Earliest papers here
- Improving the Robustness of Deep Neural Networks via Stability Training (CVPR 2016 · 600 citations)
- On Detecting Adversarial Perturbations (ICLR 2017 · 213 citations)
- Houdini: Fooling Deep Structured Visual and Speech Recognition Models with Adversarial Examples (NeurIPS 2017 · 127 citations)
What has been tried
70 papers here report 723 measured changes (a component added, removed or swapped, compared with a baseline): helped 58%, no clear effect 8%, hurt 28%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add U-Net to the architecture | MFNet · mIoU | 0.594 -> 0.745 | Helped | A²RNet: Adversarial Attack Resilient Network for Robust Infrared and Visible Image Fusion (AAAI 2025 · 19 citations) |
| Add CA to Encoder | PubLayNet-P · P-Avg mAP | 69.0 -> 67.8 | Hurt | RoDLA: Benchmarking the Robustness of Document Layout Analysis Models (CVPR 2024 · 14 citations) |
| apply SoA perturbations to stitching inputs | UDIS-D and RWCC · stitching performance | Hurt | Towards Robust Image Stitching: An Adaptive Resistance Learning against Compatible Attacks (AAAI 2024 · 13 citations) | |
| Add concept-guided purification rather than omit concept inversion | Cosal2015; CoSOD3k · SR | 0.5186 -> 0.5602; 0.4424 -> 0.4659 | Helped | CosalPure: Learning Concept from Group Images for Robust Co-Saliency Detection (CVPR 2024 · 8 citations) |
| Add OD loss | COCO ablation mean, benign · mAP | 0.571 -> 0.584 | Helped | KDAT: Inherent Adversarial Robustness via Knowledge Distillation with Adversarial Tuning for Object Detection Models (AAAI 2025 · 5 citations) |
| Use dynamic adversarial degradation generation instead of random degradation selection | Stripe noise · VIF | 0.7162 -> 0.9310 | Helped | DEAL: Data-Efficient Adversarial Learning for High-Quality Infrared Imaging (CVPR 2025 · 3 citations) |
| increase the ImageNet guidance parameter from c=5 to c=10 | ImageNet transferability and defense average · success rate (%) | 51.6 -> 55.9 | Helped | Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspective (NeurIPS 2024 · 3 citations) |
| Reduce the mask count from 36 to 16 | MS-COCO 2014 validation · average precision | maximum AP drop of 2 points | Hurt | PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches (CVPR 2025 · 2 citations) |
| Remove malicious QP-matrix encoding from codec hijacking | NeVS video restoration · visual restoration quality | No clear effect | On the Robustness of Neural-Enhanced Video Streaming against Adversarial Attacks (AAAI 2024 · 1 citation) | |
| Increase hinge-loss margin from 0.2 to 0.5 | NIGHT, certified at 36/255 · certified 2AFC score | 62.88 -> 66.39 | Helped | LipSim: A Provably Robust Perceptual Similarity Metric (ICLR 2024 · 1 citation) |
| Increase sampling ratio from 5% to 40% | Kinetics-Sounds · successful defense rate | 72.1 -> 83.0 | Helped | Rethinking Audio-Visual Adversarial Vulnerability from Temporal and Modality Perspectives (ICLR 2025 · 0 citations) |
| Place the JPEG layer after the first convolution instead of at the input | CUB-200 · top-1 accuracy | 58.81 -> 59.27 | Helped | JPEG Inspired Deep Learning (ICLR 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 11 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- M3FD · 2 of 11 papers
- INRIA · 2 of 11 papers
- ImageNet-1k · 2 of 11 papers
Baselines
- AT · 2 of 11 papers
- ObjectSeeker · 2 of 11 papers
- PAD · 2 of 11 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 36 papers; from OpenAlex and the papers' affiliations).
- Dalian University of Technology · 3 papers
- Nanyang Technological University · 3 papers
- MSU Institute for Artificial Intelligence · 2 papers
- Hong Kong University of Science and Technology · 2 papers
- Google · 2 papers
- A*STAR · 2 papers
- New York University · 2 papers
- Princeton University · 2 papers
- Harvard University · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
- Latency and driving-perception attacks (25 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).