% Key papers for Attack evaluation and defense critique (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{icml2018_obfuscated_36883,
  title = {{Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2018},
  url = {https://icml.cc/virtual/2018/poster/2217},
}

@inproceedings{icml2020_reliable_38692,
  title = {{Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2020},
  url = {https://icml.cc/virtual/2020/poster/6842},
}

@inproceedings{iclr2018_characterizing_28413,
  title = {{Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/328},
}

@inproceedings{neurips2019_adversarial_57877,
  title = {{Adversarial Examples Are Not Bugs, They Are Features}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14481},
}

@inproceedings{icml2018_adversarial_36504,
  title = {{Adversarial Risk and the Dangers of Evaluating Against Weak Attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2018},
  url = {https://icml.cc/virtual/2018/poster/2138},
}

@inproceedings{iclr2018_stochastic_28502,
  title = {{Stochastic Activation Pruning for Robust Adversarial Defense}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/71},
}

@inproceedings{iclr2018_mitigating_28614,
  title = {{Mitigating Adversarial Effects Through Randomization}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/238},
}

@inproceedings{cvpr2019_barrage_13887,
  title = {{Barrage of Random Transforms for Adversarially Robust Defense}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2020_detecting_15403,
  title = {{Detecting Adversarial Samples Using Influence Functions and Nearest Neighbors}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{icml2019_adversarial_37141,
  title = {{Adversarial Examples Are a Natural Consequence of Test Error in Noise}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/3917},
}

@inproceedings{icml2019_adversarial_37145,
  title = {{Adversarial examples from computational constraints}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/3956},
}

@inproceedings{neurips2018_constructing_56968,
  title = {{Constructing Unrestricted Adversarial Examples with Generative Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2018},
  url = {https://nips.cc/virtual/2018/poster/11795},
}

@inproceedings{aaai2018_towards_101287,
  title = {{Towards Imperceptible and Robust Adversarial Example Attacks Against Neural Networks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2018},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/11499},
}

@inproceedings{aaai2020_generating_100296,
  title = {{Generating Adversarial Examples for Holding Robustness of Source Code Processing Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5469},
}

@inproceedings{icml2018_analyzing_36518,
  title = {{Analyzing the Robustness of Nearest Neighbors to Adversarial Examples}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2018},
  url = {https://icml.cc/virtual/2018/poster/2076},
}

@inproceedings{neurips2017_learning_56443,
  title = {{Learning to Pivot with Adversarial Networks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2017},
  url = {https://nips.cc/virtual/2017/poster/8892},
}

@inproceedings{iclr2019_are_29126,
  title = {{Are adversarial examples inevitable?}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2019},
  url = {https://iclr.cc/virtual/2019/poster/885},
}

@inproceedings{neurips2019_on_58714,
  title = {{On Relating Explanations and Adversarial Examples}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/14473},
}

@inproceedings{aaai2019_connecting_100218,
  title = {{Connecting the Digital and Physical World: Improving the Robustness of Adversarial Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2019},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/3926},
}

@inproceedings{aaai2021_detecting_418,
  title = {{Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2021},
  url = {https://aaai.org/papers/09877-detecting-adversarial-examples-from-sensitivity-inconsistency-of-spatial-transform-domain/},
}

@inproceedings{aaai2025_can_8378,
  title = {{Can Go AIs Be Adversarially Robust?}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34980},
}

@inproceedings{icml2024_oodrobustbench_45182,
  title = {{OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shift}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/33270},
}

@inproceedings{neurips2024_faster_72404,
  title = {{Faster Repeated Evasion Attacks in Tree Ensembles}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/94951},
}

@inproceedings{neurips2024_constrained_72789,
  title = {{Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/94607},
}

@inproceedings{iclr2024_theoretical_34613,
  title = {{Theoretical Understanding of Learning from Adversarial Perturbations}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/18461},
}

@inproceedings{aaai2025_adversarial_8062,
  title = {{Adversarial Learning Under Hybrid Perturbations for Robust Acute Lymphoblastic Leukemia Classification}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32204},
}

@inproceedings{icml2024_the_43363,
  title = {{The Pitfalls and Promise of Conformal Inference Under Adversarial Attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/35089},
}

@inproceedings{icml2026_on_51748,
  title = {{On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=PUIivg3GrO},
}

@inproceedings{neurips2024_wide_70225,
  title = {{Wide Two-Layer Networks can Learn from Adversarial Perturbations}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96861},
}

@inproceedings{iclr2025_on_81878,
  title = {{On the Adversarial Vulnerability of Label-Free Test-Time Adaptation}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/29905},
}

@inproceedings{iclr2025_adversaries_82304,
  title = {{Adversaries With Incentives: A Strategic Alternative to Adversarial Robustness}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/29487},
}

@inproceedings{iclr2026_drift_85109,
  title = {{DRIFT: Divergent Response in Filtered Transformations for Robust Adversarial Defense}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=AYH7uBK1Gg},
}

@inproceedings{iclr2026_reducing_85213,
  title = {{Reducing information dependency does not cause training data privacy. Adversarially non-robust features do.}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=BnEG8pn3pK},
}

@inproceedings{cvpr2026_irisfp_97712,
  title = {{IrisFP: Adversarial-Example-based Model Fingerprinting with Enhanced Uniqueness and Robustness}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Geng_IrisFP_Adversarial-Example-based_Model_Fingerprinting_with_Enhanced_Uniqueness_and_Robustness_CVPR_2026_paper.html},
}

@inproceedings{cvpr2026_a_98765,
  title = {{A Unified Perspective on Adversarial Membership Manipulation in Vision Models}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Gao_A_Unified_Perspective_on_Adversarial_Membership_Manipulation_in_Vision_Models_CVPR_2026_paper.html},
}

@inproceedings{aaai2026_angular_101174,
  title = {{Angular Gradient Sign Method: Uncovering Vulnerabilities in Hyperbolic Networks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/37475},
}

@inproceedings{aaai2026_debiased_105636,
  title = {{Debiased Dual-Invariant Defense for Adversarially Robust Person Re-Identification}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/38392},
}

@inproceedings{aaai2026_drfgd_106352,
  title = {{DRFGD: Disentangled Representation-Focused Generative Defense for Attack-Tolerant Cross-Modal Hashing}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/38659},
}

@inproceedings{aaai2026_exploiting_107076,
  title = {{Exploiting Missing Data Remediation Strategies Using Adversarial Missingness Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39428},
}

@inproceedings{cvpr2025_doppelgangers_25994,
  title = {{Doppelgangers and Adversarial Vulnerability}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/32497},
}