Research map / Adversarial robustness and security / Attacks on text and graphs
Defenses against universal perturbations
Detect, denoise or generative-purify adversarial examples and perturbations.
97 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Attacks on text and graphs, keyword cluster “generative · purification · diffusion”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
23 papers in 2023–24 and 16 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 8.2% to 3.3%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Universal Adversarial Perturbations (CVPR 2017 · 2,731 citations)
- 2018 · Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models (ICLR 2018 · 279 citations)
- 2019 · Detection Based Defense Against Adversarial Examples From the Steganalysis Point of View (CVPR 2019 · 126 citations)
- 2020 · On Adaptive Attacks to Adversarial Example Defenses (NeurIPS 2020 · 137 citations)
- 2021 · Adversarial Training with Fast Gradient Projection Method against Synonym Substitution Based Text Attacks (AAAI 2021 · 65 citations)
- 2022 · LAS-AT: Adversarial Training With Learnable Attack Strategy (CVPR 2022 · 151 citations)
- 2023 · Adversarial Counterfactual Visual Explanations (CVPR 2023 · 34 citations)
- 2024 · Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · 11 citations)
- 2025 · Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · 6 citations)
- 2026 · Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approach (AAAI 2026 · 1 citation)
Earliest papers here
- Universal Adversarial Perturbations (CVPR 2017 · 2,731 citations)
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models (ICLR 2018 · 279 citations)
- Defense Against Universal Adversarial Perturbations (CVPR 2018 · 211 citations)
What has been tried
86 papers here report 883 measured changes (a component added, removed or swapped, compared with a baseline): helped 68%, no clear effect 6%, hurt 21%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add random perturbation to the defensive-noise update | CIFAR-10, adversarial training ρa=4/255 · test accuracy (%) | 37.91 -> 30.03 | Helped | Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · 11 citations) |
| add LIME word-importance ranking instead of randomly selecting words | MR (BERT) · ASR | 30.1 -> 39.3 | Helped | LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attack (AAAI 2024 · 9 citations) |
| Add curriculum learning with gradually increasing model and data neighborhoods | ImageNet, 500 training images · fooling ratio | Helped | Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · 6 citations) | |
| add attention regularization (α=1) instead of removing it | MVTec AD · AUROC | 60.7 -> 71.1 | Helped | PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · 6 citations) |
| Add saliency detection model fs to the sparse mask | ImageNet100 generative-based attacks · AUROC | w/o fs: 0.9755, 0.9585, 0.9320, 0.9197, 0.9135 | Helped | Detecting Adversarial Data Using Perturbation Forgery (CVPR 2025 · 5 citations) |
| add JS consistency loss between benign and recombined samples | CIFAR-10 · PGD-20 accuracy | 57.06±0.51 -> 57.55±0.15 | Helped | DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain (NeurIPS 2024 · 5 citations) |
| Apply all-channel Push-Down to AlexNet Conv1–Conv5 | ImageNet, top-k feature visualization by layer · CLIP-δ | 0.043; 0.056; 0.127; 0.205; 0.249 | Mixed | Adversarial Attacks on the Interpretation of Neuron Activation Maximization (AAAI 2024 · 4 citations) |
| Add self-correct adversarial training (SC) | Hybrid · F1 | 75.2 -> 75.6 | Helped | Learning from Mistakes: Self-correct Adversarial Training for Chinese Unnatural Text Correction (AAAI 2025 · 2 citations) |
| add unlabeled data rather than training on labeled data only | CIFAR10 · Mean accuracy | 36.08±0.18 -> 59.40±0.05 | Helped | Weakly Supervised Contrastive Adversarial Training for Learning Robust Features from Semi-supervised Data (CVPR 2025 · 2 citations) |
| remove the first purification stage | CIFAR-10 (mean across UEs) · accuracy | 90.01 -> 80.52 | Hurt | Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders (ICML 2024 · 2 citations) |
| Combine label consistency and representation similarity rather than use an individual mechanism | CIFAR-10 and CIFAR-100, varied perturbation budgets · AUC | Helped | Be Your Own Neighborhood: Detecting Adversarial Examples by the Neighborhood Relations Built on Self-Supervised Learning (ICML 2024 · 2 citations) | |
| Add FSAM to the noise-only attack | SYSU-MM01 · mAP | 18.28 -> 12.17 | Helped | Feature-Level Adversarial Attacks and Ranking Disruption for Visible-Infrared Person Re-identification (NeurIPS 2024 · 2 citations) |
What reviewers will expect
Datasets and baselines named in the 12 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 2 of 12 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 39 papers; from OpenAlex and the papers' affiliations).
- Michigan State University · 3 papers
- Xidian University · 3 papers
- Huazhong University of Science and Technology · 3 papers
- Beihang University · 2 papers
- University of Science and Technology of China · 2 papers
- Lehigh University · 2 papers
- Jinan University · 2 papers
- Tencent · 2 papers
- Sharif University of Technology · 2 papers
- Baidu · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Graph neural network robustness (71 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Vision-language model robustness (96 papers)
- Biologically inspired robust vision (77 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
- Neural network watermarking (53 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).