Research map / Adversarial robustness and security / Certified and empirical robustness
Robustness-accuracy trade-off analysis
Study adversarial training and its evaluation, including trade-offs with accuracy and weak-attack pitfalls.
148 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Certified and empirical robustness, keyword cluster “adversarially · generalization · overfitting”
State History Benchmarks Tried Baselines Checklist Preprints Who Export
Where it stands
Few recent reports None of the tracked benchmarks has a report from 2025–26.
39 papers in 2023–24 and 29 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic held steady, from 12.9% to 12.6%.
No longer reported by papers here: CIFAR-10 (clean accuracy, last in 2024); CIFAR-10 (PGD-20 accuracy, last in 2023); CIFAR-10 (AutoAttack accuracy, last in 2024); CIFAR-100 (Clean accuracy, last in 2024).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Towards Deep Learning Models Resistant to Adversarial Attacks (ICLR 2018 · 1,508 citations)
- 2019 · Theoretically Principled Trade-off between Robustness and Accuracy (ICML 2019 · 1,119 citations)
- 2020 · Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (AAAI 2020 · 183 citations)
- 2021 · Adversarial Robustness Under Long-Tailed Distribution (CVPR 2021 · 86 citations)
- 2022 · Robustness and Accuracy Could Be Reconcilable by (Proper) Definition (ICML 2022 · 25 citations)
- 2023 · Delving into the Adversarial Robustness of Federated Learning (AAAI 2023 · 43 citations)
- 2024 · Towards Understanding and Improving Adversarial Robustness of Vision Transformers (CVPR 2024 · 19 citations)
- 2025 · AUTE: Peer-Alignment and Self-Unlearning Boost Adversarial Robustness for Training Ensemble Models (AAAI 2025 · 2 citations)
- 2026 · Improving Adversarial Robustness of Attribution via Implicit Regularization (ICML 2026 · 0 citations)
Earliest papers here
- Towards Deep Learning Models Resistant to Adversarial Attacks (ICLR 2018 · 1,508 citations)
- Adversarially Robust Generalization Requires More Data (NeurIPS 2018 · 500 citations)
- Robust Classification With Convolutional Prototype Learning (CVPR 2018 · 473 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
CIFAR-10 · clean accuracy (higher is better)
6 papers, 2022–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 81.4 | Masking Adversarial Damage: Finding Adversarial Saliency for Robust and Sparse Network (CVPR 2022 · 12 citations) |
| 2023 | 91.24 | TWINS: A Fine-Tuning Framework for Improved Transferability of Adversarial Robustness and Generalization (CVPR 2023 · 18 citations) |
| 2024 | 94.18 | Initialization Matters for Adversarial Transfer Learning (CVPR 2024 · 6 citations) |
CIFAR-10 · PGD-20 accuracy (higher is better)
5 papers, 2020–2023 · not reported since 2023
| Year | Best so far | Set by |
|---|---|---|
| 2020 | 57.12 | Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (ICML 2020 · 83 citations) |
| 2023 | 63.71 | Adversarial Robustness via Random Projection Filters (CVPR 2023 · 17 citations) |
CIFAR-10 · AutoAttack accuracy (higher is better)
4 papers, 2022–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 45.1 | Masking Adversarial Damage: Finding Adversarial Saliency for Robust and Sparse Network (CVPR 2022 · 12 citations) |
| 2023 | 68.71 | Adversarial Robustness via Random Projection Filters (CVPR 2023 · 17 citations) |
CIFAR-100 · Clean accuracy (higher is better)
4 papers, 2023–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2023 | 70.72 | TWINS: A Fine-Tuning Framework for Improved Transferability of Adversarial Robustness and Generalization (CVPR 2023 · 18 citations) |
| 2024 | 76.25 | Initialization Matters for Adversarial Transfer Learning (CVPR 2024 · 6 citations) |
What has been tried
121 papers here report 1,244 measured changes (a component added, removed or swapped, compared with a baseline): helped 60%, no clear effect 10%, hurt 25%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Use LPIPS rather than cross-entropy to perturb scaling factors | CIFAR10 · PGD-100 robust accuracy | 60.13 -> 58.01 | Helped | Towards Understanding and Improving Adversarial Robustness of Vision Transformers (CVPR 2024 · 19 citations) |
| test-time ELBO purification instead of reconstruction-only purification | CIFAR-10 · BPDA accuracy | 47.43 vs 43.02 | Helped | Adversarial Purification with the Manifold Hypothesis (AAAI 2024 · 7 citations) |
| Combine FAAL fine-tuning with AWP | CIFAR-10 · AutoAttack worst-class accuracy (%) | 35.70 -> 36.90 | Helped | Towards Fairness-Aware Adversarial Learning (CVPR 2024 · 7 citations) |
| Use adversarial rather than standard linear probing to initialize the head | CIFAR-10 and Caltech-256 · PGD robustness | 52.85(-2.57); 52.93(-1.56); 53.01(-1.31); 51.47(-3.03) | Helped | Initialization Matters for Adversarial Transfer Learning (CVPR 2024 · 6 citations) |
| use one DF step followed by one projection | CIFAR-10, DF/SDF variants · Median-ℓ2 | 0.15 -> 0.13 | Helped | SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · 4 citations) |
| add Peer-Alignment | CIFAR-10, 3-member ResNet-20 · clean accuracy (%) | 76.7 -> 79.0 | Helped | AUTE: Peer-Alignment and Self-Unlearning Boost Adversarial Robustness for Training Ensemble Models (AAAI 2025 · 2 citations) |
| Add RGP-based selective weight updates and Revision to adversarial training | CIFAR-10 · NRR | 60.95 -> 63.19 | Helped | Conserve-Update-Revise to Cure Generalization and Robustness Trade-off in Adversarial Training (ICLR 2024 · 1 citation) |
| add class-wise loss weighting | CIFAR-10 · robust worst accuracy | 21.31 ± 1.19 -> 28.10 ± 1.26 | Helped | DAFA: Distance-Aware Fair Adversarial Training (ICLR 2024 · 1 citation) |
| Add maxpool to the first layer, without increasing kernel size or filters | CIFAR10 · PGD accuracy | 27.22 -> 45.37 | Helped | First Line of Defense: A Robust First Layer Mitigates Adversarial Attacks (AAAI 2025 · 0 citations) |
| Increase attack temperature T1 from 0.001 to 0.1 | CIFAR-100, OPSA attack · Size | 22.06 ± 0.20 -> 29.35 ± 0.26 | Helped | Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability (ICML 2025 · 0 citations) |
| Add stop-gradient to naive invariance regularization | CIFAR10 · Clean accuracy | 82.93 -> 82.47 | Hurt | Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · 0 citations) |
| Increase the unrolled iteration count from K=0 to K=4 | MNIST, ε=0.3 · accuracy | 0.0 -> 18.0 | Helped | Robustness Reprogramming for Representation Learning (ICLR 2025 · 0 citations) |
Baseline numbers that disagree
The same baseline on the same benchmark and metric, reported more than 5% apart by different papers here. Training budgets, data splits and reimplementations differ, so state which number you compare with.
| Baseline | Benchmark | Metric | Reported | Papers |
|---|---|---|---|---|
| TRADES | SVHN | PGD-20 accuracy (%) | 47.12 – 50.9 | 2 papers, e.g. CVPR 2023 and ICLR 2021 |
What reviewers will expect
Datasets and baselines named in the 13 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 9 of 13 papers
- CIFAR-100 · 5 of 13 papers
- MNIST · 3 of 13 papers
- TinyImageNet · 3 of 13 papers
- ImageNet · 2 of 13 papers
- Imagenette · 2 of 13 papers
- SVHN · 2 of 13 papers
Baselines
- TRADES · 5 of 13 papers
- MART · 4 of 13 papers
- AWP · 3 of 13 papers
- PGD-AT · 2 of 13 papers
- adversarial training · 2 of 13 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 68 papers; from OpenAlex and the papers' affiliations).
- Amazon · 4 papers
- Tsinghua University · 3 papers
- The University of Sydney · 3 papers
- University of Pennsylvania · 3 papers
- Zhejiang University · 2 papers
- SenseTime · 2 papers
- Sun Yat-sen University · 2 papers
- Imperial College London · 2 papers
- City University of Hong Kong · 2 papers
- Google · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
- Theory of adversarial risk (59 papers)
Elsewhere in the topic
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Adversarial training recipes (68 papers)
- Decision-boundary geometry of robustness (61 papers)
- Randomized smoothing certification (49 papers)
- Regularized defenses against attacks (40 papers)
- Certified training and ensembles (35 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).