Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial training recipes
Improve robust training through fast training, pretraining, teacher guidance and local features.
68 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Certified and empirical robustness, keyword cluster “cifar · 10 · imagenet”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
17 papers in 2023–24 and 9 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 5.6% to 3.9%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Measuring Neural Net Robustness with Constraints (NeurIPS 2016 · 114 citations)
- 2017 · Parseval Networks: Improving Robustness to Adversarial Examples (ICML 2017 · 169 citations)
- 2018 · Thermometer Encoding: One Hot Way To Resist Adversarial Examples (ICLR 2018 · 455 citations)
- 2019 · Are Labels Required for Improving Adversarial Robustness? (NeurIPS 2019 · 174 citations)
- 2020 · Fast is better than free: Revisiting adversarial training (ICLR 2020 · 576 citations)
- 2021 · Attribute-Guided Adversarial Training for Robustness to Natural Perturbations (AAAI 2021 · 24 citations)
- 2022 · Subspace Adversarial Training (CVPR 2022 · 65 citations)
- 2023 · Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations (CVPR 2023 · 34 citations)
- 2024 · Revisiting Adversarial Training at Scale (CVPR 2024 · 27 citations)
- 2025 · 3SAT: A Simple Self-Supervised Adversarial Training Framework (AAAI 2025 · 3 citations)
- 2026 · Mind Your Margin and Boundary: Are Your Distilled Datasets Truly Robust? (ICML 2026 · 0 citations)
Earliest papers here
- Measuring Neural Net Robustness with Constraints (NeurIPS 2016 · 114 citations)
- Parseval Networks: Improving Robustness to Adversarial Examples (ICML 2017 · 169 citations)
- Thermometer Encoding: One Hot Way To Resist Adversarial Examples (ICLR 2018 · 455 citations)
What has been tried
59 papers here report 658 measured changes (a component added, removed or swapped, compared with a baseline): helped 66%, no clear effect 9%, hurt 22%, mixed 3%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| replace full-resolution inputs with resizing to 112×112 during pre-training | ImageNet-1K · PGD-20 robust accuracy | 54.5 -> 52.5 | Hurt | Revisiting Adversarial Training at Scale (CVPR 2024 · 27 citations) |
| Adding warm-up phase (200 epochs) for the self-supervised part before adversarial training (dynamic training objective scheduling) | CIFAR-100 · AA(%) and SA(%) | SA +6.83 (51.06→57.89); AA +3.08 (24.96→28.04) | Helped | 3SAT: A Simple Self-Supervised Adversarial Training Framework (AAAI 2025 · 3 citations) |
| Increase label smoothing from 0.0 to 0.1 | CIFAR-10 (ℓ∞, ϵ = 8/255) · AA accuracy | 70.52 -> 71.07 | Helped | Vision Transformers Beat WideResNets on Small Scale Datasets Adversarial Robustness (AAAI 2025 · 2 citations) |
| Infrequently resample training examples instead of reloading the sampler state | CIFAR10 · performance | No clear effect | Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies (ICML 2024 · 2 citations) | |
| Increase logit-pairing weight λ | CIFAR-10 · clean accuracy | Hurt | RAMP: Boosting Adversarial Robustness Against Multiple $l_p$ Perturbations for Universal Robustness (NeurIPS 2024 · 2 citations) | |
| reduce JPEG quality parameter ν from 85 to 75 at τ=0.3 | ImageNet · RA | 5% | Helped | Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks (AAAI 2024 · 1 citation) |
| Replace multiplicative perturbations with additive Gaussian weight perturbations (DAAP) | CIFAR-10/100 and TinyImageNet corruption evaluation · corruption robustness | Hurt | Improving robustness to corruptions with multiplicative weight perturbations (NeurIPS 2024 · 1 citation) | |
| add EWC regularization | continual robust training · robust accuracy | Hurt | Adapting to Evolving Adversaries with Regularized Continual Robust Training (ICML 2025 · 0 citations) | |
| Increase α from 0.7 to 0.9 | CIFAR-10, PGD · SA | 89.81 -> 83.27 | Hurt | Optimizing Robustness and Accuracy in Mixture of Experts: A Dual-Model Approach (ICML 2025 · 0 citations) |
| Add rotation- and scale-equivariant branches to the parallel design | CIFAR-100, ε=0.01, PGD · accuracy (%) | 24.72 -> 29.62 | Helped | Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness (NeurIPS 2025 · 0 citations) |
| Lower epsilon-low while holding epsilon at 12/255 | Image classification (dataset not specified for the figure) · Natural accuracy | Helped | Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training (ICML 2024 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 5 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 5 of 5 papers
- CIFAR-100 · 4 of 5 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 26 papers; from OpenAlex and the papers' affiliations).
- Chinese Academy of Sciences · 2 papers
- Seoul National University · 2 papers
- Carnegie Mellon University · 2 papers
- University of Illinois, Urbana Champaign · 2 papers
Use it
Download BibTeX of 34 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Regularized defenses against attacks (40 papers)
- Augmentation and diffusion purification (30 papers)
- Adversarial training with feature consistency (135 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Decision-boundary geometry of robustness (61 papers)
- Theory of adversarial risk (59 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).