Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial training refinements
Reweight examples and classes or tune training to improve robustness and convergence.
87 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Certified and empirical robustness, keyword cluster “adversarially · generalization · overfitting”
State History Benchmarks Tried Baselines Checklist Preprints Who Export
Where it stands
Quiet None of the tracked benchmarks has a report from 2025–26.
32 papers in 2023–24 and 16 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 10.6% to 6.9%.
Open questions the data points to
- Papers report MART on CIFAR-100 (AA accuracy) anywhere from 25.13 to 44.8: comparisons against it depend on whose number you take.
No longer reported by papers here: CIFAR10 (clean accuracy, last in 2024); CIFAR-10 (Natural accuracy, last in 2024); CIFAR-10 (PGD-20 accuracy, last in 2024); CIFAR100 (clean accuracy, last in 2024).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients (AAAI 2018 · 460 citations)
- 2019 · A Little Is Enough: Circumventing Defenses For Distributed Learning (NeurIPS 2019 · 98 citations)
- 2020 · Improving Adversarial Robustness Requires Revisiting Misclassified Examples (ICLR 2020 · 285 citations)
- 2021 · Understanding Catastrophic Overfitting in Single-step Adversarial Training (AAAI 2021 · 75 citations)
- 2022 · Consistency Regularization for Adversarial Robustness (AAAI 2022 · 51 citations)
- 2023 · Boosting Accuracy and Robustness of Student Models via Adaptive Adversarial Distillation (CVPR 2023 · 55 citations)
- 2024 · Revisiting Adversarial Training Under Long-Tailed Distributions (CVPR 2024 · 18 citations)
- 2025 · Enhancing Robustness in Incremental Learning with Adversarial Training (AAAI 2025 · 3 citations)
- 2026 · Benign Overfitting in Adversarial Training for Vision Transformers (ICML 2026 · 0 citations)
Earliest papers here
- Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients (AAAI 2018 · 460 citations)
- Sparse DNNs with Improved Adversarial Robustness (NeurIPS 2018 · 94 citations)
- A Little Is Enough: Circumventing Defenses For Distributed Learning (NeurIPS 2019 · 98 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
CIFAR10 · clean accuracy (higher is better)
5 papers, 2020–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2020 | 93.24 | Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization (CVPR 2020 · 111 citations) |
CIFAR-10 · Natural accuracy (higher is better)
4 papers, 2021–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2021 | 86.61 | Neural Architecture Dilation for Adversarial Robustness (NeurIPS 2021 · 10 citations) |
| 2023 | 90.01 | Memorization Weights for Instance Reweighting in Adversarial Training (AAAI 2023 · 3 citations) |
| 2024 | 95.5 | On the Duality Between Sharpness-Aware Minimization and Adversarial Training (ICML 2024 · 0 citations) |
CIFAR-10 · PGD-20 accuracy (higher is better)
4 papers, 2020–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2020 | 82.31 | Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization (CVPR 2020 · 111 citations) |
CIFAR100 · clean accuracy (higher is better)
4 papers, 2020–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2020 | 74.81 | Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization (CVPR 2020 · 111 citations) |
What has been tried
74 papers here report 849 measured changes (a component added, removed or swapped, compared with a baseline): helped 64%, no clear effect 7%, hurt 25%, mixed 3%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add Balanced Softmax Loss to AT | CIFAR-10-LT · AA robustness (%) | 26.75 -> 29.48 | Helped | Revisiting Adversarial Training Under Long-Tailed Distributions (CVPR 2024 · 18 citations) |
| add test-time FGSM purification | CIFAR-10 · PGD-20 accuracy | 0.18 -> 79.06 | Helped | Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM (CVPR 2024 · 14 citations) |
| Set smoothing level r to 0.0 | CIFAR-10 · robust accuracy | 54.9 -> 43.7 | Hurt | Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · 11 citations) |
| add SWA to PeerAiD | TinyImageNet, ResNet-18 · AA accuracy | 20.00 -> 21.67 | Helped | PeerAiD: Improving Adversarial Distillation from a Specialized Peer Tutor (CVPR 2024 · 9 citations) |
| Use KL divergence instead of ListNet for the adversarial ranking loss | MS MARCO Passage Ranking · RobustMRR@10 | 0.2035 -> 0.2008 | Hurt | Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off (AAAI 2024 · 8 citations) |
| Add FPD to FLAIR | S-CIFAR10 without memory buffer · Gradient Forgetting | 0.964 -> 0.582 | Helped | Enhancing Robustness in Incremental Learning with Adversarial Training (AAAI 2025 · 3 citations) |
| add AE manifold projection to PGD-AT | CIFAR-10 ResNet-18 transfer attacks · AutoAttack accuracy under transfer | 63.96 to 68.02 (ResNet-34 surrogate); 66.61 to 71.09 (VGG-16 surrogate) | Helped | Enhancing the Adversarial Robustness via Manifold Projection (AAAI 2025 · 3 citations) |
| Remove adversarial attacks during training while retaining ELLE regularization | SVHN, ε=12/255 · PGD-20 accuracy | 32.17% -> 5.07% | Hurt | Efficient local linearity regularization to overcome catastrophic overfitting (ICLR 2024 · 2 citations) |
| Add sparsity regularization | CIFAR-10, white-box PGD50 · accuracy (%) | 0.00 -> 11.70 | Helped | Enhancing Adversarial Robustness in SNNs with Sparse Gradients (ICML 2024 · 1 citation) |
| Add Adaptive Scaling after fixed-parameterized SSMs | CIFAR-10 · PGD-10 and AA accuracy | more than a 2% improvement in RA | Helped | Exploring Adversarial Robustness of Deep State Space Models (NeurIPS 2024 · 1 citation) |
| Add clean-example soft-label re-tempering in addition to adversarial-example re-tempering | CIFAR-10 · class-wise optimization error-risk standard deviation | Helped | Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillation (NeurIPS 2024 · 1 citation) | |
| Add random jumps to a new initialization after cycle detection | CIFAR100 and CIFAR10 · robust accuracy | 45.02 -> 45.03; 38.93 -> 38.68; 48.19 -> 47.85; 40.30 -> 40.33; 62.02 -> 61.92; 59.05 -> 58.78; 59.61 -> 59.34 | Mixed | Stop Walking in Circles! Bailing Out Early in Projected Gradient Descent (CVPR 2025 · 0 citations) |
Baseline numbers that disagree
The same baseline on the same benchmark and metric, reported more than 5% apart by different papers here. Training budgets, data splits and reimplementations differ, so state which number you compare with.
| Baseline | Benchmark | Metric | Reported | Papers |
|---|---|---|---|---|
| MART | CIFAR-100 | AA accuracy | 25.13 – 44.8 | 3 papers, e.g. ICLR 2023 and ICLR 2022 |
What reviewers will expect
Datasets and baselines named in the 10 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 5 of 10 papers
- CIFAR-100 · 4 of 10 papers
- Tiny ImageNet · 3 of 10 papers
- ImageNet · 2 of 10 papers
Baselines
- TRADES · 4 of 10 papers
- PGD-AT · 3 of 10 papers
- MART · 2 of 10 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 48 papers; from OpenAlex and the papers' affiliations).
- Peking University · 5 papers
- Wuhan University · 3 papers
- Amazon · 3 papers
- Tsinghua University · 3 papers
- The University of Sydney · 3 papers
- Chinese Academy of Sciences · 2 papers
- Swiss Federal Institute of Technology Lausanne · 2 papers
- EPFL · 2 papers
- Harbin Institute of Technology · 2 papers
- University of Wisconsin - Madison · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness-accuracy trade-off analysis (148 papers)
- Attack evaluation and defense critique (103 papers)
- Robust overfitting and regularization (79 papers)
- Theory of adversarial risk (59 papers)
Elsewhere in the topic
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Adversarial training recipes (68 papers)
- Decision-boundary geometry of robustness (61 papers)
- Randomized smoothing certification (49 papers)
- Regularized defenses against attacks (40 papers)
- Certified training and ensembles (35 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).