Research map / Adversarial robustness and security / Certified and empirical robustness
Decision-boundary geometry of robustness
Analyze decision boundaries and universal perturbations to explain adversarial vulnerability.
61 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Certified and empirical robustness, keyword cluster “verification · bounds · worst case”
State History Benchmarks Tried Checklist Preprints Export
Where it stands
Quiet None of the tracked benchmarks has a report from 2025–26.
12 papers in 2023–24 and 8 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 4.0% to 3.5%.
No longer reported by papers here: CIFAR-10 test (accuracy, last in 2022); MNIST test (accuracy, last in 2022).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks (CVPR 2016 · 5,359 citations)
- 2018 · Lightweight Probabilistic Deep Networks (CVPR 2018 · 172 citations)
- 2019 · Hierarchical interpretations for neural network predictions (ICLR 2019 · 97 citations)
- 2020 · MMA Training: Direct Input Space Margin Maximization through Adversarial Training (ICLR 2020 · 92 citations)
- 2021 · MaxUp: Lightweight Adversarial Training With Data Augmentation Improves Neural Network Training (CVPR 2021 · 48 citations)
- 2022 · Well-Classified Examples Are Underestimated in Classification with Deep Neural Networks (AAAI 2022 · 15 citations)
- 2023 · A Practical Upper Bound for the Worst-Case Attribution Deviations (CVPR 2023 · 3 citations)
- 2024 · Curvature Clues: Decoding Deep Learning Privacy with Input Loss Curvature (NeurIPS 2024 · 4 citations)
- 2025 · Contrasting Adversarial Perturbations: The Space of Harmless Perturbations (AAAI 2025 · 0 citations)
- 2026 · Counterfactual Explanations on Robust Perceptual Geodesics (ICLR 2026 · 0 citations)
Earliest papers here
- DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks (CVPR 2016 · 5,359 citations)
- Lightweight Probabilistic Deep Networks (CVPR 2018 · 172 citations)
- Empirical Study of the Topology and Geometry of Deep Networks (CVPR 2018 · 124 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
CIFAR-10 test · accuracy (higher is better)
4 papers, 2018–2022 · not reported since 2022
| Year | Best so far | Set by |
|---|---|---|
| 2018 | 91.87 | Lightweight Probabilistic Deep Networks (CVPR 2018 · 172 citations) |
| 2020 | 92.28 | Interpolation between Residual and Non-Residual Networks (ICML 2020 · 3 citations) |
| 2022 | 94.24 | Well-Classified Examples Are Underestimated in Classification with Deep Neural Networks (AAAI 2022 · 15 citations) |
MNIST test · accuracy (higher is better)
4 papers, 2018–2022 · not reported since 2022
| Year | Best so far | Set by |
|---|---|---|
| 2018 | 99.5 | Lightweight Probabilistic Deep Networks (CVPR 2018 · 172 citations) |
| 2022 | 99.56 | Well-Classified Examples Are Underestimated in Classification with Deep Neural Networks (AAAI 2022 · 15 citations) |
What has been tried
51 papers here report 524 measured changes (a component added, removed or swapped, compared with a baseline): helped 65%, no clear effect 8%, hurt 20%, mixed 7%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add mirror augmentation to the image | ImageNet, CIFAR100, and CIFAR10 · AUROC | ImageNet: 75.84 { ± 0.08} -> 77.45 { ± 0.09}; CIFAR100: 92.72 { ± 0.23} -> 93.49 { ± 0.18}; CIFAR10: 67. | Helped | Curvature Clues: Decoding Deep Learning Privacy with Input Loss Curvature (NeurIPS 2024 · 4 citations) |
| remove the Hessian-related term from R2ET | Adult, ERAttack · P@k | 92.1 -> 97.5 | Helped | Training for Stable Explanation for Free (NeurIPS 2024 · 3 citations) |
| Increase L1-norm AT coefficient from ϵ=0.01 to ϵ=0.10 | ImageNette · Gini (%) | 56.73 -> 65.53 | Helped | Structured Gradient-based Interpretations via Norm-Regularized Adversarial Training (CVPR 2024 · 2 citations) |
| Use quantized inputs for gradient computations rather than quantizing only to check for a Chimera | CIFAR-10, CPU-based backends · Chimera attack success rate | approximately 2.2× more Chimera examples | Helped | Adversarial Inputs for Linear Algebra Backends (ICML 2025 · 0 citations) |
| Add randomized smoothing | Adversarial evaluation · Rob.Acc | 98.2 -> 99.5 | Helped | Improving Interpretation Faithfulness for Vision Transformers (ICML 2024 · 0 citations) |
| Vary weight decay | CIFAR10 · region migration onset | Mixed | Deep Networks Always Grok and Here is Why (ICML 2024 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 9 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 6 of 9 papers
- MNIST · 4 of 9 papers
- ImageNet · 4 of 9 papers
- CIFAR100 · 3 of 9 papers
- ImageNette · 2 of 9 papers
Recent preprints
Loading recent arXiv preprints…
Use it
Download BibTeX of 33 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Robustness to poisoning and multiple attacks (32 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
- Theory of adversarial risk (59 papers)
- Randomized smoothing certification (49 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).