Research map / Adversarial robustness and security / Certified and empirical robustness
Regularized defenses against attacks
Add regularizers, detection or domain adaptation to harden networks against adversarial examples.
40 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2025) · an approach in Certified and empirical robustness, keyword cluster “cifar · 10 · imagenet”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
6 papers in 2023–24 and 4 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 2.0% to 1.7%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · 285 citations)
- 2019 · Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses (CVPR 2019 · 255 citations)
- 2020 · Adversarial Examples Improve Image Recognition (CVPR 2020 · 473 citations)
- 2021 · Perceptual Adversarial Robustness: Defense Against Unseen Threat Models (ICLR 2021 · 19 citations)
- 2022 · Your Out-of-Distribution Detection Method is Not Robust! (NeurIPS 2022 · 2 citations)
- 2023 · Towards Optimal Randomized Strategies in Adversarial Example Game (AAAI 2023 · 0 citations)
- 2024 · Taxonomy Driven Fast Adversarial Training (AAAI 2024 · 17 citations)
- 2025 · AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples (AAAI 2025 · 18 citations)
Earliest papers here
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · 285 citations)
- Deep Defense: Training DNNs with Improved Adversarial Robustness (NeurIPS 2018 · 88 citations)
- Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses (CVPR 2019 · 255 citations)
What has been tried
35 papers here report 381 measured changes (a component added, removed or swapped, compared with a baseline): helped 65%, no clear effect 5%, hurt 25%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add batch momentum initialization to standard single-step AT | CIFAR-10 · PGD-10 accuracy | 41.70/14.60 -> 53.82/53.70 | Helped | Taxonomy Driven Fast Adversarial Training (AAAI 2024 · 17 citations) |
| Add AToP fine-tuning to RT1 | CIFAR-10, FGSM (ε=8/255) · robust accuracy | 16.60 -> 91.99 | Helped | Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · 2 citations) |
| add MMD-OPT-based denoising and the two-pronged inference process | CIFAR-10, adaptive PGD+EOT ℓ∞ (ε=8/255) · clean accuracy | 85.07 ± 0.16 -> 94.16 ± 0.08 | Helped | One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy (ICML 2025 · 0 citations) |
| Increase k-hat | ImageNet, ResNet50 · ANC | 16.3 at k-hat=10; 4.36 at k-hat=100 | Helped | GSE: Group-wise Sparse and Explainable Adversarial Attacks (ICLR 2025 · 0 citations) |
| replace the cross-entropy attack loss with the rejection-aware LREJ loss | MNIST · robust accuracy | 0.988 -> 0.972 | Hurt | Two Heads are Actually Better than One: Towards Better Adversarial Robustness via Transduction and Rejection (ICML 2024 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 9 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 6 of 9 papers
- CIFAR-100 · 4 of 9 papers
- ImageNet · 3 of 9 papers
Baselines
- MART · 2 of 9 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 10 papers; from OpenAlex and the papers' affiliations).
- RIKEN · 2 papers
Use it
Download BibTeX of 27 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Adversarial training recipes (68 papers)
- Augmentation and diffusion purification (30 papers)
- Adversarial training with feature consistency (135 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Decision-boundary geometry of robustness (61 papers)
- Theory of adversarial risk (59 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).