Research map / Adversarial robustness and security / Certified and empirical robustness
Theory of adversarial risk
Formalize adversarially robust learning, Bayes classifiers and PAC-Bayes bounds.
59 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Certified and empirical robustness, keyword cluster “adversarially · generalization · overfitting”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
14 papers in 2023–24 and 18 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 4.6% to 7.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution (NeurIPS 2018 · 8 citations)
- 2019 · The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure (AAAI 2019 · 97 citations)
- 2020 · Measuring Robustness to Natural Distribution Shifts in Image Classification (NeurIPS 2020 · 166 citations)
- 2021 · Evaluating Robustness of Predictive Uncertainty Estimation: Are Dirichlet-based Models Reliable? (ICML 2021 · 5 citations)
- 2022 · PixMix: Dreamlike Pictures Comprehensively Improve Safety Measures (CVPR 2022 · 103 citations)
- 2023 · Seasoning Model Soups for Robustness to Adversarial and Natural Distribution Shifts (CVPR 2023 · 11 citations)
- 2024 · Collaboration! Towards Robust Neural Methods for Routing Problems (NeurIPS 2024 · 2 citations)
- 2025 · On the Robustness of Distributed Machine Learning Against Transfer Attacks (AAAI 2025 · 1 citation)
- 2026 · Adversarially Robust Approximate Furthest Neighbor (ICML 2026 · 0 citations)
Earliest papers here
- Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution (NeurIPS 2018 · 8 citations)
- The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure (AAAI 2019 · 97 citations)
- Robustness to Adversarial Perturbations in Learning from Incomplete Data (NeurIPS 2019 · 71 citations)
What has been tried
42 papers here report 347 measured changes (a component added, removed or swapped, compared with a baseline): helped 50%, no clear effect 15%, hurt 28%, mixed 7%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add global adversarial attack generation alongside local attacks | TSP100 Fixed Adv. (100) · optimality gap | Helped | Collaboration! Towards Robust Neural Methods for Routing Problems (NeurIPS 2024 · 2 citations) | |
| Diversify optimizer | CIFAR10 · robust accuracy | -0.0012 | No clear effect | On the Robustness of Distributed Machine Learning Against Transfer Attacks (AAAI 2025 · 1 citation) |
| Increase statistical budget γ | CIFAR-10, training over epochs · robust overfitting | Helped | Provable Robust Overfitting Mitigation in Wasserstein Distributionally Robust Optimization (ICLR 2025 · 0 citations) | |
| Replace pReLU with ReLU | 12 positive and 8 negative clusters (D = 2000) · ℓ2 robustness | Hurt | Gradient Flow Provably Learns Robust Classifiers for Orthonormal GMMs (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 9 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR10 · 2 of 9 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 32 papers; from OpenAlex and the papers' affiliations).
- New York University · 2 papers
- University of Chicago · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Robustness-accuracy trade-off analysis (148 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
Elsewhere in the topic
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Neural network robustness verification (87 papers)
- Adversarial training recipes (68 papers)
- Decision-boundary geometry of robustness (61 papers)
- Randomized smoothing certification (49 papers)
- Regularized defenses against attacks (40 papers)
- Certified training and ensembles (35 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).