Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial training with feature consistency
Improve robustness via information-theoretic, distillation and consistency regularizers.
135 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Certified and empirical robustness, keyword cluster “cifar · 10 · imagenet”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Few recent reports None of the tracked benchmarks has a report from 2025–26.
43 papers in 2023–24 and 46 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 14.2% to 19.9%.
No longer reported by papers here: ImageNet-C (mCE, last in 2024).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Learning Sleep Stages from Radio Signals: A Conditional Adversarial Architecture (ICML 2017)
- 2018 · Generating Informative and Diverse Conversational Responses via Adversarial Information Maximization (NeurIPS 2018 · 178 citations)
- 2019 · Fooling Neural Network Interpretations via Adversarial Model Manipulation (NeurIPS 2019 · 117 citations)
- 2020 · Adversarial Filters of Dataset Biases (ICML 2020 · 159 citations)
- 2021 · Regularizing Generative Adversarial Networks Under Limited Data (CVPR 2021 · 135 citations)
- 2022 · Improved Text Classification via Contrastive Adversarial Training (AAAI 2022 · 95 citations)
- 2023 · BiasAdv: Bias-Adversarial Augmentation for Model Debiasing (CVPR 2023 · 25 citations)
- 2024 · Pre-trained Model Guided Fine-Tuning for Zero-Shot Adversarial Robustness (CVPR 2024 · 27 citations)
- 2025 · CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIP (CVPR 2025 · 8 citations)
- 2026 · BiRQA: Bidirectional Robust Quality Assessment for Images (ICML 2026 · 0 citations)
Earliest papers here
- Learning Sleep Stages from Radio Signals: A Conditional Adversarial Architecture (ICML 2017)
- Generating Informative and Diverse Conversational Responses via Adversarial Information Maximization (NeurIPS 2018 · 178 citations)
- Invariant Representations without Adversarial Training (NeurIPS 2018 · 101 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
ImageNet-C · mCE (lower is better)
5 papers, 2021–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2021 | 48 | Are Transformers more robust than CNNs? (NeurIPS 2021 · 92 citations) |
| 2024 | 34.4 | Harnessing Edge Information for Improved Robustness in Vision Transformers (AAAI 2024 · 7 citations) |
What has been tried
109 papers here report 1,245 measured changes (a component added, removed or swapped, compared with a baseline): helped 67%, no clear effect 6%, hurt 22%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add the generalization information branch (Lgeneral) | 16 zero-shot datasets, average clean accuracy · accuracy | +11.29% | Helped | Pre-trained Model Guided Fine-Tuning for Zero-Shot Adversarial Robustness (CVPR 2024 · 27 citations) |
| Set finite-difference step size h to 0.001 | LIVEC test, FGSM · RMSE between scores before and after attack | 19.065 -> 7.356 | Helped | Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization (CVPR 2024 · 19 citations) |
| Add stability discriminator | Beauty and Toys · Hit@10 | 0.0737 -> 0.0762; 0.0847 -> 0.0855 | Mixed | Sparse Enhanced Network: An Adversarial Generation Method for Robust Augmentation in Sequential Recommendation (AAAI 2024 · 18 citations) |
| add dense connections to MLP blocks | ViTs · adversarial transferability | 56.2 -> 66.0 | Helped | Improving the Adversarial Transferability of Vision Transformers with Virtual Dense Connection (AAAI 2024 · 16 citations) |
| Add IAKD to ARKD | CIFAR-10 · AA accuracy | 50.66 -> 51.70 | Helped | Robust Distillation via Untargeted and Targeted Intermediate Adversarial Samples (CVPR 2024 · 16 citations) |
| Add attribution region alignment to slack matching | CIFAR-10 · robust accuracy | Helped | Adversarial Distillation Based on Slack Matching and Attribution Region Alignment (CVPR 2024 · 10 citations) | |
| Use full DFARD with ITA and AGB | CIFAR-10 · average adversarial accuracy | 27.53 -> 35.31 | Helped | Out of Thin Air: Exploring Data-Free Adversarial Robustness Distillation (AAAI 2024 · 9 citations) |
| increase the number of counterattack steps N | multiple datasets, ϵa = 1/255 and ϵa = 4/255 · robust accuracy (%) | Mixed | CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIP (CVPR 2025 · 8 citations) | |
| Use cross-entropy loss for 40 initial epochs instead of omitting it | CIFAR-10-LT (IR=10) · clean sample accuracy | +7.19% | Helped | TAET: Two-Stage Adversarial Equalization Training on Long-Tailed Distributions (CVPR 2025 · 7 citations) |
| Use 4 new EdgeNet blocks (# Intervals = 3) instead of fine-tuning only the classification head | ImageNet-1K FGSM · accuracy (%) | 41.1 -> 69.8 | Helped | Harnessing Edge Information for Improved Robustness in Vision Transformers (AAAI 2024 · 7 citations) |
| Use only random token r1; do not optimize r2 | CIFAR-10 · PGD accuracy | 50.07 -> 49.34 | Hurt | Random Entangled Tokens for Adversarially Robust Vision Transformer (CVPR 2024 · 7 citations) |
| add SCAA to DDPG | FetchPick, SCR attack · discounted return | 85.57% | Helped | Representation-Based Robustness in Goal-Conditioned Reinforcement Learning (AAAI 2024 · 6 citations) |
What reviewers will expect
Datasets and baselines named in the 29 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 9 of 29 papers
- CIFAR-100 · 7 of 29 papers
- ImageNet · 4 of 29 papers
- Tiny-ImageNet · 4 of 29 papers
- SVHN · 3 of 29 papers
- VoxCeleb1 · 2 of 29 papers
- ImageNet100 · 2 of 29 papers
- ImageNet-1K · 2 of 29 papers
Baselines
- PGD-AT · 4 of 29 papers
- TRADES · 4 of 29 papers
- AT · 3 of 29 papers
- PGD · 3 of 29 papers
- AutoAttack · 2 of 29 papers
- SegPGD · 2 of 29 papers
- DDC-AT · 2 of 29 papers
- TeCoA · 2 of 29 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 89 papers; from OpenAlex and the papers' affiliations).
- The University of Sydney · 6 papers
- Sun Yat-sen University · 4 papers
- Huazhong University of Science and Technology · 4 papers
- University of Illinois, Urbana Champaign · 3 papers
- Xidian University · 3 papers
- Peking University · 3 papers
- Korea Advanced Institute of Science and Technology · 3 papers
- Nanyang Technological University · 3 papers
- A*STAR · 3 papers
- The Chinese University of Hong Kong · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Adversarial training recipes (68 papers)
- Regularized defenses against attacks (40 papers)
- Augmentation and diffusion purification (30 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Decision-boundary geometry of robustness (61 papers)
- Theory of adversarial risk (59 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).