Research map / Adversarial robustness and security / Certified and empirical robustness
Robust overfitting and regularization
Explain and reduce robust overfitting and improve generalization of adversarially trained models.
79 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Certified and empirical robustness, keyword cluster “adversarially · generalization · overfitting”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
16 papers in 2023–24 and 22 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 5.3% to 9.5%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · A Closer Look at Memorization in Deep Networks (ICML 2017 · 891 citations)
- 2018 · A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks (NeurIPS 2018 · 982 citations)
- 2019 · Manifold Mixup: Better Representations by Interpolating Hidden States (ICML 2019 · 470 citations)
- 2020 · High-Frequency Component Helps Explain the Generalization of Convolutional Neural Networks (CVPR 2020 · 639 citations)
- 2021 · Natural Adversarial Examples (CVPR 2021 · 837 citations)
- 2022 · Improving Adversarially Robust Few-Shot Image Classification With Generalizable Representations (CVPR 2022 · 33 citations)
- 2023 · Generalist: Decoupling Natural and Robust Generalization (CVPR 2023 · 12 citations)
- 2024 · Boosting Adversarial Training via Fisher-Rao Norm-based Regularization (CVPR 2024 · 10 citations)
- 2025 · SAP: Corrective Machine Unlearning with Scaled Activation Projection for Label Noise Robustness (AAAI 2025 · 4 citations)
- 2026 · MPD-SGR: Robust Spiking Neural Networks with Membrane Potential Distribution-Driven Surrogate Gradient Regularization (AAAI 2026 · 1 citation)
Earliest papers here
- A Closer Look at Memorization in Deep Networks (ICML 2017 · 891 citations)
- Deep Variational Information Bottleneck (ICLR 2017 · 347 citations)
- A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks (NeurIPS 2018 · 982 citations)
What has been tried
68 papers here report 764 measured changes (a component added, removed or swapped, compared with a baseline): helped 68%, no clear effect 9%, hurt 19%, mixed 4%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Apply SLORE before E1 and after E2 rather than at only one phase | CIFAR10 · clean test accuracy | 83.39 -> 83.41; 82.65 -> 83.41 | Helped | Boosting Adversarial Training via Fisher-Rao Norm-based Regularization (CVPR 2024 · 10 citations) |
| directly include sampled hider examples in training rather than use an auxiliary model | CIFAR-10 · PGD20 accuracy | 52.64 -> 48.90 | Hurt | Focus on Hiders: Exploring Hidden Threats for Enhancing Adversarial Training (CVPR 2024 · 7 citations) |
| Increase SCRUB retain and forget samples from 1000/200 to 5000/1000 | CIFAR10 synthetic label noise (Table 1 average) · test accuracy | 86.35 -> 87.65 | Helped | SAP: Corrective Machine Unlearning with Scaled Activation Projection for Label Noise Robustness (AAAI 2025 · 4 citations) |
| add untargeted adversarial perturbations | ImageNet-C · mCE | 52.2 -> 48.7 (-3.5) | Helped | Gain from Neighbors: Boosting Model Robustness in the Wild via Adversarial Perturbations Toward Neighboring Classes (CVPR 2025 · 2 citations) |
| Set loss threshold too small or too large | Natural, multi-step AT, and single-step AT · test error or robustness | Mixed | On the Over-Memorization During Natural, Robust and Catastrophic Overfitting (ICLR 2024 · 2 citations) | |
| Use majority voting across random seeds | Associative recall · success rate | Helped | Learning Randomized Algorithms with Transformers (ICLR 2025 · 0 citations) | |
| remove spectral regularization (α=0.0) | CIFAR-10 ℓ∞, AutoAttack · worst-class accuracy | 33.80 -> 12.90 | Hurt | Enhancing Robust Fairness via Confusional Spectral Regularization (ICLR 2025 · 0 citations) |
| Replace curvature regularization with gradient regularization | ImageNette 1, 10, and 50 IPC; attacks in the ablation table · accuracy | Hurt | Towards Adversarially Robust Dataset Distillation by Curvature Regularization (AAAI 2025) | |
| Use adaptive targets rather than one-hot targets | CIFAR10 · robust test error | Helped | On the Impact of Hard Adversarial Instances on Overfitting in Adversarial Training (ICML 2025) | |
| Add regularization Γα(·) | MNIST, APGD · accuracy | 93.513±0.046 -> 94.907±0.187 | Helped | On the Diversity of Adversarial Ensemble Learning (ICML 2025) |
| Add adversarial attacks | OOD detection benchmarks · OOD detection performance | Helped | Splitting & Integrating: Out-of-Distribution Detection via Adversarial Gradient Attribution (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 16 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR10 · 9 of 16 papers
- ImageNet-1K · 4 of 16 papers
- CIFAR100 · 3 of 16 papers
- Tiny ImageNet · 3 of 16 papers
- SVHN · 3 of 16 papers
- MNIST · 2 of 16 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 38 papers; from OpenAlex and the papers' affiliations).
- Peking University · 2 papers
- Johns Hopkins University · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness-accuracy trade-off analysis (148 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Theory of adversarial risk (59 papers)
Elsewhere in the topic
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Adversarial training recipes (68 papers)
- Decision-boundary geometry of robustness (61 papers)
- Randomized smoothing certification (49 papers)
- Regularized defenses against attacks (40 papers)
- Certified training and ensembles (35 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).