Research map / Adversarial robustness and security / Certified and empirical robustness
Attack evaluation and defense critique
Analyze adversarial examples, attack strength and why defenses fail.
103 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Certified and empirical robustness, keyword cluster “adversarially · generalization · overfitting”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
16 papers in 2023–24 and 18 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 5.3% to 7.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Learning to Pivot with Adversarial Networks (NeurIPS 2017 · 88 citations)
- 2018 · Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (ICML 2018 · 1,118 citations)
- 2019 · Adversarial Examples Are Not Bugs, They Are Features (NeurIPS 2019 · 389 citations)
- 2020 · Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · 582 citations)
- 2021 · Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain (AAAI 2021 · 61 citations)
- 2022 · Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack (CVPR 2022 · 45 citations)
- 2023 · The Enemy of My Enemy Is My Friend: Exploring Inverse Adversaries for Improving Adversarial Training (CVPR 2023 · 37 citations)
- 2024 · OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shift (ICML 2024 · 3 citations)
- 2025 · Can Go AIs Be Adversarially Robust? (AAAI 2025 · 3 citations)
- 2026 · On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification (ICML 2026 · 0 citations)
Earliest papers here
- Learning to Pivot with Adversarial Networks (NeurIPS 2017 · 88 citations)
- Explicit Defense Actions Against Test-Set Attacks (AAAI 2017 · 50 citations)
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (ICML 2018 · 1,118 citations)
What has been tried
82 papers here report 751 measured changes (a component added, removed or swapped, compared with a baseline): helped 55%, no clear effect 11%, hurt 27%, mixed 7%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Restrict adversarial perturbations to frequently modified features and prune the ensemble | Ten classification datasets; 10,000 test examples · run time | 2.4x-25.4x; 1.6x-35.9x | Helped | Faster Repeated Evasion Attacks in Tree Ensembles (NeurIPS 2024 · 2 citations) |
| Add adaptive step-size selection | URL, LCLD, CTU, WIDS · robust accuracy | up to 32.1% | Helped | Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data (NeurIPS 2024 · 2 citations) |
| Add MixBN to pixel-level PGD adversarial training | C_NMC · ACC | 68.398 -> 70.166 | Helped | Adversarial Learning Under Hybrid Perturbations for Robust Acute Lymphoblastic Leukemia Classification (AAAI 2025 · 0 citations) |
| Increase risk-mitigation probability epsilon | CIFAR-10, well-specified opponent · strategic accuracy | Hurt | Adversaries With Incentives: A Strategic Alternative to Adversarial Robustness (ICLR 2025 · 0 citations) | |
| Add Beta weighting by TCPR to adversarial training | CIFAR10, CIFAR100, Caltech256, and CUB200 · PSS | AT: 2.54(0.04) -> 2.50(0.04), 14.29(0.59) -> 11.61(0.40), 23.73(1.68) -> 18.54(1.32), 17.75(0.71) -> 16.56(0.76); FAT: 2 | Mixed | The Pitfalls and Promise of Conformal Inference Under Adversarial Attacks (ICML 2024 · 0 citations) |
| add GSAT instead of normal adversarial training | CIFAR 10 · Robust accuracy | 60.64 ± 0.02 -> 73.41 ± 2.04 | Helped | Adversarial Robustness via Deformable Convolution with Stochasticity (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 7 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 2 of 7 papers
- CIFAR-100 · 2 of 7 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 34 papers; from OpenAlex and the papers' affiliations).
- Defence Science and Technology Group · 2 papers
- Massachusetts Institute of Technology · 2 papers
- Chiba University · 2 papers
- The University of Tokyo · 2 papers
- City University of Hong Kong · 2 papers
- University of California, Berkeley · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
- Theory of adversarial risk (59 papers)
Elsewhere in the topic
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Adversarial training recipes (68 papers)
- Decision-boundary geometry of robustness (61 papers)
- Randomized smoothing certification (49 papers)
- Regularized defenses against attacks (40 papers)
- Certified training and ensembles (35 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).