Research map / Adversarial robustness and security / Certified and empirical robustness
Robustness to poisoning and multiple attacks
Benchmark and certify defenses against poisoning and multiple threat models.
32 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Certified and empirical robustness, keyword cluster “verification · bounds · worst case”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
12 papers in 2023–24 and 6 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 4.0% to 2.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Certified Defenses for Data Poisoning Attacks (NeurIPS 2017 · 82 citations)
- 2018 · Efficient Formal Safety Analysis of Neural Networks (NeurIPS 2018 · 173 citations)
- 2019 · Combinatorial Attacks on Binarized Neural Networks (ICLR 2019 · 19 citations)
- 2020 · Abstract Interpretation of Decision Tree Ensemble Classifiers (AAAI 2020 · 40 citations)
- 2021 · Expressive 1-Lipschitz Neural Networks for Robust Multiple Graph Learning against Adversarial Attacks (ICML 2021 · 6 citations)
- 2022 · Robust Optimal Classification Trees against Adversarial Examples (AAAI 2022 · 16 citations)
- 2023 · Formalising the Robustness of Counterfactual Explanations for Neural Networks (AAAI 2023 · 20 citations)
- 2024 · Promoting Counterfactual Robustness through Diversity (AAAI 2024 · 8 citations)
- 2025 · PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks (AAAI 2025 · 2 citations)
- 2026 · Safety-Efficacy Trade Off: Robustness against Data-Poisoning (ICML 2026 · 0 citations)
Earliest papers here
- Certified Defenses for Data Poisoning Attacks (NeurIPS 2017 · 82 citations)
- Efficient Formal Safety Analysis of Neural Networks (NeurIPS 2018 · 173 citations)
- Combinatorial Attacks on Binarized Neural Networks (ICLR 2019 · 19 citations)
What has been tried
29 papers here report 249 measured changes (a component added, removed or swapped, compared with a baseline): helped 59%, no clear effect 7%, hurt 24%, mixed 10%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Remove binary-search minimisation | diabetes, no2, credit, spambase, news · k-distance (L1) | diabetes: 1.13 ± 0.43 -> 1.38 ± 0.29; no2: 0.62 ±0.23 -> 0.87 ± 0.20; credit: 0.85 ± 0.33 -> 0.88 ± 0.33; spambase: 1.12 | Hurt | Promoting Counterfactual Robustness through Diversity (AAAI 2024 · 8 citations) |
| add Nash mixed trees to the Hall of Fame rather than only the highest-fitness tree | fashion-mnist · max regret | .256 -> .240 | Helped | Coevolutionary Algorithm for Building Robust Decision Trees under Minimax Regret (AAAI 2024 · 2 citations) |
| Add Nash voting rather than equal voting | 20 benchmark datasets (average) · adversarial accuracy | 0.779 -> 0.784 | Helped | Cultivating Archipelago of Forests: Evolving Robust Decision Trees Through Island Coevolution (AAAI 2025 · 0 citations) |
| Increase width from 5 to 30 with 2 layers | Two Moons, ε=0.01, 1 epoch · training time | 0.75 s -> 27.7 s | Hurt | MIBP-Cert: Certified Training against Data Perturbations with Mixed-Integer Bilinear Programs (NeurIPS 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 10 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- diabetes · 3 of 10 papers
- wine · 3 of 10 papers
- mnist · 3 of 10 papers
- ionos · 2 of 10 papers
- breast · 2 of 10 papers
- bank · 2 of 10 papers
- Japan:3v4 · 2 of 10 papers
- spam · 2 of 10 papers
Baselines
- Meta Silvae · 2 of 10 papers
- GROOT · 2 of 10 papers
- FPRDT · 2 of 10 papers
- DiCE · 2 of 10 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 18 papers; from OpenAlex and the papers' affiliations).
- Imperial College London · 3 papers
- Warsaw University of Technology · 2 papers
- AGH University of Krakow · 2 papers
- The Ohio State University · 2 papers
Use it
Download BibTeX of 26 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Decision-boundary geometry of robustness (61 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
- Theory of adversarial risk (59 papers)
- Randomized smoothing certification (49 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).