% Key papers for Adversarial training recipes (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{iclr2020_fast_29317,
  title = {{Fast is better than free: Revisiting adversarial training}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=BJx040EFvH},
}

@inproceedings{iclr2018_thermometer_28572,
  title = {{Thermometer Encoding: One Hot Way To Resist Adversarial Examples}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/120},
}

@inproceedings{cvpr2020_adversarial_15131,
  title = {{Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{neurips2019_are_57910,
  title = {{Are Labels Required for Improving Adversarial Robustness?}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14185},
}

@inproceedings{icml2017_parseval_36338,
  title = {{Parseval Networks: Improving Robustness to Adversarial Examples}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2017},
  url = {https://icml.cc/virtual/2017/poster/830},
}

@inproceedings{neurips2016_measuring_55867,
  title = {{Measuring Neural Net Robustness with Constraints}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2016},
  url = {https://nips.cc/virtual/2016/poster/6893},
}

@inproceedings{iclr2019_adv_29171,
  title = {{Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2019},
  url = {https://iclr.cc/virtual/2019/poster/663},
}

@inproceedings{neurips2018_hessian_57197,
  title = {{Hessian-based Analysis of Large Batch Training and Robustness to Adversaries}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2018},
  url = {https://nips.cc/virtual/2018/poster/11485},
}

@inproceedings{neurips2019_a_57804,
  title = {{A Fourier Perspective on Model Robustness in Computer Vision}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14266},
}

@inproceedings{neurips2020_robust_60740,
  title = {{Robust Pre-Training by Adversarial Contrastive Learning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/18244},
}

@inproceedings{neurips2019_unlabeled_59149,
  title = {{Unlabeled Data Improves Adversarial Robustness}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14113},
}

@inproceedings{neurips2019_reverse_58913,
  title = {{Reverse KL-Divergence Training of Prior Networks: Improved Uncertainty and Adversarial Robustness}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14370},
}

@inproceedings{cvpr2022_subspace_19958,
  title = {{Subspace Adversarial Training}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2022},
}

@inproceedings{iclr2020_robust_29422,
  title = {{Robust Local Features for Improving the Generalization of Adversarial Training}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=H1lZJpVFvr},
}

@inproceedings{icml2020_overfitting_38606,
  title = {{Overfitting in adversarially robust deep learning}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2020},
  url = {https://icml.cc/virtual/2020/poster/6258},
}

@inproceedings{cvpr2020_what_16484,
  title = {{What It Thinks Is Important Is Important: Robustness Transfers Through Input Gradients}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2023_towards_22372,
  title = {{Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/21999},
}

@inproceedings{iclr2019_l2_28852,
  title = {{L2-Nonexpansive Neural Networks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2019},
  url = {https://iclr.cc/virtual/2019/poster/1134},
}

@inproceedings{neurips2020_hydra_59986,
  title = {{HYDRA: Pruning Adversarially Robust Neural Networks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/18662},
}

@inproceedings{cvpr2024_revisiting_24651,
  title = {{Revisiting Adversarial Training at Scale}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/30800},
}

@inproceedings{aaai2025_3sat_7874,
  title = {{3SAT: A Simple Self-Supervised Adversarial Training Framework}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/33815},
}

@inproceedings{aaai2025_vision_11250,
  title = {{Vision Transformers Beat WideResNets on Small Scale Datasets Adversarial Robustness}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32073},
}

@inproceedings{icml2024_adversarial_43988,
  title = {{Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/34464},
}

@inproceedings{neurips2024_ramp_74256,
  title = {{RAMP: Boosting Adversarial Robustness Against Multiple \$l\_p\$ Perturbations for Universal Robustness}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/93300},
}

@inproceedings{aaai2024_closing_5405,
  title = {{Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/30187},
}

@inproceedings{neurips2024_improving_71746,
  title = {{Improving robustness to corruptions with multiplicative weight perturbations}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/95542},
}

@inproceedings{icml2024_improving_44128,
  title = {{Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/34324},
}

@inproceedings{icml2025_adapting_47313,
  title = {{Adapting to Evolving Adversaries with Regularized Continual Robust Training}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/45276},
}

@inproceedings{icml2025_optimizing_47937,
  title = {{Optimizing Robustness and Accuracy in Mixture of Experts: A Dual-Model Approach}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/44667},
}

@inproceedings{icml2026_mind_52670,
  title = {{Mind Your Margin and Boundary: Are Your Distilled Datasets Truly Robust?}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=Y3K0pPyVcs},
}

@inproceedings{icml2026_non_53242,
  title = {{Non-Parametric Probabilistic Robustness: A Conservative Risk Estimator under Unknown Perturbation Distributions}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=ddIUBkzwIU},
}

@inproceedings{icml2026_dual_54133,
  title = {{Dual-branch Robust Unlearnable Examples}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=mHhdnUufwR},
}

@inproceedings{neurips2025_bridging_80202,
  title = {{Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=xDxskDUvte},
}

@inproceedings{iclr2026_lipnext_84443,
  title = {{LipNeXt: Scaling up Lipschitz-based Certified Robustness to Billion-parameter Models}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=2fgzEJPH02},
}