% Key papers for Robustness benchmarks and defenses (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{iclr2018_ensemble_28698,
  title = {{Ensemble Adversarial Training: Attacks and Defenses}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/157},
}

@inproceedings{cvpr2018_defense_12992,
  title = {{Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2018},
  url = {https://openaccess.thecvf.com/content_cvpr_2018/html/Liao_Defense_Against_Adversarial_CVPR_2018_paper.html},
}

@inproceedings{cvpr2019_feature_14202,
  title = {{Feature Denoising for Improving Adversarial Robustness}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{iclr2018_generating_28482,
  title = {{Generating Natural Adversarial Examples}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/142},
}

@inproceedings{iclr2018_countering_28634,
  title = {{Countering Adversarial Images using Input Transformations}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/139},
}

@inproceedings{cvpr2019_efficient_14131,
  title = {{Efficient Decision-Based Black-Box Adversarial Attacks on Face Recognition}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{iclr2017_adversarial_28223,
  title = {{Adversarial Machine Learning at Scale}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2017},
  url = {https://openreview.net/forum?id=BJm4T4Kgx},
}

@inproceedings{cvpr2019_parametric_14624,
  title = {{Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2020_benchmarking_15189,
  title = {{Benchmarking Adversarial Robustness on Image Classification}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{aaai2018_unravelling_104082,
  title = {{Unravelling Robustness of Deep Learning Based Face Recognition Against Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2018},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/12341},
}

@inproceedings{cvpr2020_when_16489,
  title = {{When NAS Meets Robustness: In Search of Robust Architectures Against Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2019_meshadv_14509,
  title = {{MeshAdv: Adversarial Meshes for Visual Recognition}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{neurips2021_robustbench_62267,
  title = {{RobustBench: a standardized adversarial robustness benchmark}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2021},
  url = {https://openreview.net/forum?id=SSKZPJCt7B},
}

@inproceedings{icml2019_metricgan_37541,
  title = {{MetricGAN: Generative Adversarial Networks based Black-box Metric Scores Optimization for Speech Enhancement}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/3820},
}

@inproceedings{cvpr2020_colorfool_15261,
  title = {{ColorFool: Semantic Adversarial Colorization}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2020_on_15972,
  title = {{On Isometry Robustness of Deep 3D Point Cloud Models Under Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{neurips2018_robust_57585,
  title = {{Robust Detection of Adversarial Attacks by Modeling the Intrinsic Properties of Deep Neural Networks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2018},
  url = {https://nips.cc/virtual/2018/poster/11759},
}

@inproceedings{cvpr2021_iou_17210,
  title = {{IoU Attack: Towards Temporally Coherent Black-Box Adversarial Attack for Visual Object Tracking}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{iclr2019_a_29014,
  title = {{A Direct Approach to Robust Deep Learning Using Adversarial Networks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2019},
  url = {https://iclr.cc/virtual/2019/poster/908},
}

@inproceedings{iclr2018_cascade_28559,
  title = {{Cascade Adversarial Machine Learning Regularized with a Unified Embedding}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/324},
}

@inproceedings{icml2024_cospgd_43774,
  title = {{CosPGD: an efficient white-box adversarial attack for pixel-wise prediction tasks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/34678},
}

@inproceedings{cvpr2024_towards_25029,
  title = {{Towards Accurate and Robust Architectures via Neural Architecture Search}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/30380},
}

@inproceedings{neurips2024_query_73501,
  title = {{Query-Based Adversarial Prompt Generation}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/93975},
}

@inproceedings{aaai2024_logostylefool_6544,
  title = {{LogoStyleFool: Vitiating Video Recognition Systems via Logo Style Transfer}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/27854},
}

@inproceedings{aaai2024_robustness_7186,
  title = {{Robustness and Visual Explanation for Black Box Image, Video, and ECG Signal Classification with Reinforcement Learning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/30579},
}

@inproceedings{aaai2025_reinforcement_10503,
  title = {{Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34976},
}

@inproceedings{icml2024_manifold_45474,
  title = {{Manifold Integrated Gradients: Riemannian Geometry for Feature Attribution}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/32977},
}

@inproceedings{icml2024_badpart_45618,
  title = {{BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Tasks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/32834},
}

@inproceedings{neurips2024_improved_70764,
  title = {{Improved Generation of Adversarial Examples Against Safety-aligned LLMs}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96362},
}

@inproceedings{iclr2025_adversarial_83453,
  title = {{Adversarial Attacks on Data Attribution}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/28363},
}

@inproceedings{aaai2025_data_8640,
  title = {{Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32988},
}

@inproceedings{cvpr2025_towards_27913,
  title = {{Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/32940},
}

@inproceedings{iclr2024_pubdef_34531,
  title = {{PubDef: Defending Against Transfer Attacks From Public Models}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18543},
}

@inproceedings{icml2026_stare_51385,
  title = {{STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=Leijxx6Czi},
}

@inproceedings{neurips2025_boosting_77160,
  title = {{Boosting the Uniqueness of Neural Networks Fingerprints with Informative Triggers}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=R3C3RY25eS},
}

@inproceedings{iclr2025_confidence_82631,
  title = {{Confidence Elicitation: A New Attack Vector for Large Language Models}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/29166},
}

@inproceedings{cvpr2026_featurefool_96761,
  title = {{FeatureFool: Zero-Query Fooling of Video Models via Feature Map}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Tang_FeatureFool_Zero-Query_Fooling_of_Video_Models_via_Feature_Map_CVPR_2026_paper.html},
}

@inproceedings{cvpr2026_shedding_99089,
  title = {{Shedding Light on VLN Robustness: A Black-box Framework for Indoor Lighting-based Adversarial Attack}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Li_Shedding_Light_on_VLN_Robustness_A_Black-box_Framework_for_Indoor_CVPR_2026_paper.html},
}

@inproceedings{icml2025_adversarial_46025,
  title = {{Adversarial Perturbations Are Formed by Iteratively Learning Linear Combinations of the Right Singular Vectors of the Adversarial Jacobian}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/46521},
}

@inproceedings{icml2025_omni_46240,
  title = {{Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/46320},
}