Research map / Adversarial robustness and security / Certified and empirical robustness
Provable robust learning guarantees
Derive worst-case guarantees and relaxations for adversarially robust training.
120 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Certified and empirical robustness, keyword cluster “verification · bounds · worst case”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
19 papers in 2023–24 and 19 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 6.3% to 8.2%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Robustness of classifiers: from adversarial to random noise (NeurIPS 2016 · 217 citations)
- 2017 · Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation (NeurIPS 2017 · 278 citations)
- 2018 · Provable Defenses against Adversarial Examples via the Convex Outer Adversarial Polytope (ICML 2018 · 674 citations)
- 2019 · Exploring the Landscape of Spatial Robustness (ICML 2019 · 250 citations)
- 2020 · Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack (ICML 2020 · 118 citations)
- 2021 · DSRNA: Differentiable Search of Robust Neural Architectures (CVPR 2021 · 41 citations)
- 2022 · On Adversarial Robustness of Trajectory Prediction for Autonomous Vehicles (CVPR 2022 · 144 citations)
- 2023 · Holistic Adversarial Robustness of Deep Learning Models (AAAI 2023 · 17 citations)
- 2024 · Clarifying the Behavior and the Difficulty of Adversarial Training (AAAI 2024 · 4 citations)
- 2025 · MOS-Attack: A Scalable Multi-objective Adversarial Attack Framework (CVPR 2025 · 3 citations)
- 2026 · MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks (ICML 2026 · 0 citations)
Earliest papers here
- Robustness of classifiers: from adversarial to random noise (NeurIPS 2016 · 217 citations)
- Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation (NeurIPS 2017 · 278 citations)
- Lower bounds on the robustness to adversarial perturbations (NeurIPS 2017 · 46 citations)
What has been tried
97 papers here report 866 measured changes (a component added, removed or swapped, compared with a baseline): helped 65%, no clear effect 9%, hurt 21%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| select losses 5, 6, and 7 from the mined synergistic patterns instead of losses 0, 1, and 2 | CIFAR-10 and ImageNet · ASR | 31.19 -> 33.51; 31.63 -> 33.91; 30.23 -> 33.03; 58.82 -> 60.86 | Helped | MOS-Attack: A Scalable Multi-objective Adversarial Attack Framework (CVPR 2025 · 3 citations) |
| Use an intermediate KL constraint value rather than too-high or too-low values | Selected MuJoCo control problems · Robustness | Helped | Robust Adversarial Reinforcement Learning via Bounded Rationality Curricula (ICLR 2024 · 1 citation) | |
| Use L^∞ rather than L^1 Bellman error | Freeway · PGD reward | 0.0 ± 0.0 -> 33.2 ± 0.1 | Helped | Towards Optimal Adversarial Robust Q-learning with Bellman Infinity-error (ICML 2024 · 1 citation) |
| Apply QUB-static to FGSM-CKPT | CIFAR-10 (ResNet18) · AA | 37.22 -> 41.53 | Helped | Quadratic Upper Bound for Boosting Robustness (ICML 2025 · 0 citations) |
| Use RS-G with p = 2 | Synthetic experiment · lenient regret | Helped | Robust Satisficing Gaussian Process Bandits Under Adversarial Attacks (NeurIPS 2025 · 0 citations) | |
| Increase fixed feature-space radius from 0.01 to 0.1 | Abalone, no attack · R² | 0.56 (0.55–0.58) -> 0.38 (0.37–0.39) | Hurt | Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization (NeurIPS 2025 · 0 citations) |
| Use policy class sizes within 3 for PROTECTED | MuJoCo PA-AD attacks · episode reward | Helped | Beyond Worst-case Attacks: Robust RL with Adaptive Defense via Non-dominated Policies (ICLR 2024 · 0 citations) | |
| add adaptive τ adjustment | CIFAR-10, C10 · ASR₅₀ | 71.66 -> 73.02 | Helped | $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025) |
What reviewers will expect
Datasets and baselines named in the 11 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 3 of 11 papers
- ImageNet · 2 of 11 papers
- CIFAR-100 · 2 of 11 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 38 papers; from OpenAlex and the papers' affiliations).
- City University of Hong Kong · 3 papers
- Georgia Institute of Technology · 2 papers
- Uppsala University · 2 papers
- Ecole Normale Superieure · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Neural network robustness verification (87 papers)
- Decision-boundary geometry of robustness (61 papers)
- Robustness to poisoning and multiple attacks (32 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
- Theory of adversarial risk (59 papers)
- Randomized smoothing certification (49 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).