{"total":112,"rows":[{"id":"2109.13916","title":"Unsolved Problems in ML Safety","created":"2021-09-28","cited_by_count":292,"area":null},{"id":"2110.09468","title":"Improving Robustness using Generated Data","created":"2021-10-18","cited_by_count":234,"area":null},{"id":"2102.11436","title":"Model-Based Domain Generalization","created":"2021-02-23","cited_by_count":104,"area":null},{"id":"2101.07922","title":"LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition","created":"2021-01-20","cited_by_count":94,"area":null},{"id":"2303.01870","title":"Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models","created":"2023-03-03","cited_by_count":79,"area":null},{"id":"2203.05151","title":"Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity","created":"2022-03-10","cited_by_count":77,"area":null},{"id":"2208.08831","title":"Discovering Bugs in Vision Models using Off-the-shelf Image Generation and Captioning","created":"2022-08-18","cited_by_count":45,"area":null},{"id":"2307.10562","title":"Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples","created":"2023-07-20","cited_by_count":43,"area":null},{"id":"2301.13838","title":"Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression","created":"2023-01-31","cited_by_count":39,"area":null},{"id":"2205.07972","title":"Sparse Visual Counterfactual Explanations in Image Space","created":"2022-05-16","cited_by_count":30,"area":null},{"id":"2210.00933","title":"Perceptual Attacks of No-Reference Image Quality Models with Human-in-the-Loop","created":"2022-10-03","cited_by_count":30,"area":null},{"id":"2102.07861","title":"Low Curvature Activations Reduce Overfitting in Adversarial Training","created":"2021-02-15","cited_by_count":29,"area":null},{"id":"2104.01086","title":"Defending Against Image Corruptions Through Adversarial Augmentations","created":"2021-04-02","cited_by_count":28,"area":null},{"id":"2307.15157","title":"R-LPIPS: An Adversarially Robust Perceptual Similarity Metric","created":"2023-07-27","cited_by_count":28,"area":null},{"id":"2202.04235","title":"Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations","created":"2022-02-09","cited_by_count":26,"area":null},{"id":"2303.04278","title":"CUDA: Convolution-based Unlearnable Datasets","created":"2023-03-07","cited_by_count":26,"area":null},{"id":"2102.02145","title":"Adversarially Robust Learning with Unknown Perturbation Sets","created":"2021-02-03","cited_by_count":24,"area":null},{"id":"2105.12508","title":"Adversarial Robustness against Multiple and Single $l_p$-Threat Models via Quick Fine-Tuning of Robust Classifiers","created":"2021-05-26","cited_by_count":23,"area":null},{"id":"2110.09903","title":"Unrestricted Adversarial Attacks on ImageNet Competition","created":"2021-10-17","cited_by_count":23,"area":null},{"id":"2209.14105","title":"Exploring the Relationship between Architecture and Adversarially Robust Generalization","created":"2022-09-28","cited_by_count":23,"area":null},{"id":"2403.07937","title":"Speech Robust Bench: A Robustness Benchmark For Speech Recognition","created":"2024-03-08","cited_by_count":21,"area":null},{"id":"2109.02765","title":"Robustness and Generalization via Generative Adversarial Training","created":"2021-09-06","cited_by_count":20,"area":null},{"id":"2209.07592","title":"Explicit Tradeoffs between Adversarial and Natural Distributional Robustness","created":"2022-09-15","cited_by_count":20,"area":null},{"id":"2210.09852","title":"Scaling Adversarial Training to Large Perturbation Bounds","created":"2022-10-18","cited_by_count":20,"area":null},{"id":"2305.16035","title":"Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Score","created":"2023-05-25","cited_by_count":20,"area":null},{"id":"2207.02036","title":"PRoA: A Probabilistic Robustness Assessment against Functional Perturbations","created":"2022-07-05","cited_by_count":19,"area":null},{"id":"2305.12863","title":"Towards Benchmarking and Assessing Visual Naturalness of Physical World Adversarial Attacks","created":"2023-05-22","cited_by_count":18,"area":null},{"id":"2112.05005","title":"Mutual Adversarial Training: Learning together is better than going alone","created":"2021-12-09","cited_by_count":17,"area":null},{"id":"2305.09241","title":"Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examples","created":"2023-05-16","cited_by_count":17,"area":null},{"id":"2202.10627","title":"On the Effectiveness of Adversarial Training against Backdoor Attacks","created":"2022-02-22","cited_by_count":16,"area":null},{"id":"2311.15551","title":"Instruct2Attack: Language-Guided Semantic Adversarial Attacks","created":"2023-11-27","cited_by_count":16,"area":null},{"id":"2208.13058","title":"Adversarial Robustness for Tabular Data through Cost and Utility Awareness","created":"2022-08-27","cited_by_count":15,"area":null},{"id":"2401.16352","title":"Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization","created":"2024-01-29","cited_by_count":15,"area":null},{"id":"2203.02006","title":"Why adversarial training can hurt robust accuracy","created":"2022-03-03","cited_by_count":14,"area":null},{"id":"2201.01102","title":"Towards Transferable Unrestricted Adversarial Examples with Minimum Changes","created":"2022-01-04","cited_by_count":13,"area":null},{"id":"2306.11035","title":"Adversarial Training Should Be Cast as a Non-Zero-Sum Game","created":"2023-06-19","cited_by_count":13,"area":null},{"id":"2306.12941","title":"Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Models","created":"2023-06-22","cited_by_count":12,"area":null},{"id":"2108.13797","title":"Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings","created":"2021-08-30","cited_by_count":11,"area":null},{"id":"2111.05468","title":"Sparse Adversarial Video Attacks with Spatial Transformations","created":"2021-11-10","cited_by_count":11,"area":null},{"id":"2112.00378","title":"$\\ell_\\infty$-Robustness and Beyond: Unleashing Efficient Adversarial Training","created":"2021-12-01","cited_by_count":11,"area":null},{"id":"2112.06323","title":"Interpolated Joint Space Adversarial Training for Robust and Generalizable Defenses","created":"2021-12-12","cited_by_count":10,"area":null},{"id":"2305.08840","title":"Attacking Perceptual Similarity Metrics","created":"2023-05-15","cited_by_count":10,"area":null},{"id":"2209.05785","title":"Adversarial Coreset Selection for Efficient Robust Training","created":"2022-09-13","cited_by_count":9,"area":null},{"id":"2510.04398","title":"SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinations","created":"2025-10-05","cited_by_count":9,"area":null},{"id":"2204.13779","title":"Formulating Robustness Against Unforeseen Attacks","created":"2022-04-28","cited_by_count":8,"area":null},{"id":"2210.10620","title":"Active Image Indexing","created":"2022-10-05","cited_by_count":8,"area":null},{"id":"2301.02060","title":"A first-order augmented Lagrangian method for constrained minimax optimization","created":"2023-01-05","cited_by_count":8,"area":null},{"id":"2503.09124","title":"AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks","created":"2025-03-12","cited_by_count":8,"area":null},{"id":"2210.00973","title":"NCVX: A General-Purpose Optimization Solver for Constrained Machine and Deep Learning","created":"2022-10-03","cited_by_count":7,"area":null},{"id":"2210.15614","title":"Private and Reliable Neural Network Inference","created":"2022-10-27","cited_by_count":7,"area":null},{"id":"2302.10980","title":"MultiRobustBench: Benchmarking Robustness Against Multiple Attacks","created":"2023-02-21","cited_by_count":7,"area":null},{"id":"2108.07958","title":"Semantic Perturbations with Normalizing Flows for Improved Generalization","created":"2021-08-18","cited_by_count":6,"area":null},{"id":"2211.00824","title":"Adversarial Auto-Augment with Label Preservation: A Representation Learning Principle Guided Approach","created":"2022-11-02","cited_by_count":6,"area":null},{"id":"2303.13401","title":"Optimization and Optimizers for Adversarial Robustness","created":"2023-03-23","cited_by_count":6,"area":null},{"id":"2310.04285","title":"Assessing Robustness via Score-Based Adversarial Image Generation","created":"2023-10-06","cited_by_count":6,"area":null},{"id":"2111.13984","title":"NCVX: A User-Friendly and Scalable Package for Nonconvex Optimization in Machine Learning","created":"2021-11-27","cited_by_count":5,"area":null},{"id":"2201.12440","title":"Certifying Model Accuracy under Distribution Shifts","created":"2022-01-28","cited_by_count":5,"area":null},{"id":"2207.07797","title":"CARBEN: Composite Adversarial Robustness Benchmark","created":"2022-07-16","cited_by_count":5,"area":null},{"id":"2210.03150","title":"Towards Out-of-Distribution Adversarial Robustness","created":"2022-10-06","cited_by_count":5,"area":null},{"id":"2303.15409","title":"Class-Conditioned Transformation for Enhanced Robust Image Classification","created":"2023-03-27","cited_by_count":5,"area":null},{"id":"2302.08872","title":"Revisiting adversarial training for the worst-performing class","created":"2023-02-17","cited_by_count":4,"area":null},{"id":"2305.01139","title":"Stratified Adversarial Robustness with Rejection","created":"2023-05-02","cited_by_count":4,"area":null},{"id":"2310.12793","title":"OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shift","created":"2023-10-19","cited_by_count":4,"area":null},{"id":"2312.09481","title":"Continual Adversarial Defense","created":"2023-12-15","cited_by_count":4,"area":null},{"id":"2404.00540","title":"Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patches","created":"2024-03-31","cited_by_count":4,"area":null},{"id":"2103.15385","title":"Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training","created":"2021-03-29","cited_by_count":3,"area":null},{"id":"2111.15603","title":"Human Imperceptible Attacks and Applications to Improve Fairness","created":"2021-11-30","cited_by_count":3,"area":null},{"id":"2206.06496","title":"Towards Alternative Techniques for Improving Adversarial Robustness: Analysis of Adversarial Training at a Spectrum of Perturbations","created":"2022-06-13","cited_by_count":3,"area":null},{"id":"2207.07209","title":"Sound Randomized Smoothing in Floating-Point Arithmetics","created":"2022-07-14","cited_by_count":3,"area":null},{"id":"2210.00621","title":"Optimization for Robustness Evaluation beyond $\\ell_p$ Metrics","created":"2022-10-02","cited_by_count":3,"area":null},{"id":"2503.02169","title":"One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy","created":"2025-03-04","cited_by_count":3,"area":null},{"id":"2506.23581","title":"PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection","created":"2025-06-30","cited_by_count":3,"area":null},{"id":"2107.09502","title":"Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features","created":"2021-07-19","cited_by_count":2,"area":null},{"id":"2207.07208","title":"Provably Adversarially Robust Nearest Prototype Classifiers","created":"2022-07-14","cited_by_count":2,"area":null},{"id":"2210.02577","title":"A Closer Look at Robustness to L-infinity and Spatial Perturbations and their Composition","created":"2022-10-05","cited_by_count":2,"area":null},{"id":"2211.09782","title":"Assessing Neural Network Robustness via Adversarial Pivotal Tuning","created":"2022-11-17","cited_by_count":2,"area":null},{"id":"2303.00340","title":"A Practical Upper Bound for the Worst-Case Attribution Deviations","created":"2023-03-01","cited_by_count":2,"area":null},{"id":"2310.19889","title":"Exploring Geometry of Blind Spots in Vision Models","created":"2023-10-30","cited_by_count":2,"area":null},{"id":"2502.04248","title":"Adapting to Evolving Adversaries with Regularized Continual Robust Training","created":"2025-02-06","cited_by_count":2,"area":null},{"id":"2507.02965","title":"Concept-based Adversarial Attack: a Probabilistic Perspective","created":"2025-06-30","cited_by_count":2,"area":null},{"id":"2508.13309","title":"DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples","created":"2025-08-18","cited_by_count":2,"area":null},{"id":"2208.03958","title":"Abutting Grating Illusion: Cognitive Challenge to Neural Network Models","created":"2022-08-08","cited_by_count":1,"area":null},{"id":"2402.06827","title":"RAMP: Boosting Adversarial Robustness Against Multiple $l_p$ Perturbations for Universal Robustness","created":"2024-02-09","cited_by_count":1,"area":null},{"id":"2405.01349","title":"Position: Towards Resilience Against Adversarial Examples","created":"2024-05-02","cited_by_count":1,"area":null},{"id":"2406.03143","title":"ZeroPur: Succinct Training-Free Adversarial Purification","created":"2024-06-05","cited_by_count":1,"area":null},{"id":"2406.08829","title":"Improving Adversarial Robustness via Feature Pattern Consistency Constraint","created":"2024-06-13","cited_by_count":1,"area":null},{"id":"2504.21846","title":"Combating Falsification of Speech Videos with Live Optical Signatures (Extended Version)","created":"2025-04-30","cited_by_count":1,"area":null},{"id":"2505.22943","title":"Can LLMs Deceive CLIP? Benchmarking Adversarial Compositionality of Pre-trained Multimodal Representation via Text Updates","created":"2025-05-28","cited_by_count":1,"area":null},{"id":"2507.07776","title":"SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examples","created":"2025-07-10","cited_by_count":1,"area":null},{"id":"2507.18484","title":"Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments","created":"2025-07-24","cited_by_count":1,"area":null},{"id":"2508.00552","title":"DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification","created":"2025-08-01","cited_by_count":1,"area":null},{"id":"2604.16532","title":"Beyond Attack Success Rate: A Multi-Metric Evaluation of Adversarial Transferability in Medical Imaging Models","created":"2026-04-16","cited_by_count":1,"area":null},{"id":"2605.07690","title":"Fortifying Time Series: DTW-Certified Robust Anomaly Detection","created":"2026-05-08","cited_by_count":1,"area":null},{"id":"2605.12813","title":"REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations","created":"2026-05-12","cited_by_count":1,"area":null},{"id":"2605.16720","title":"Compositional Adversarial Training for Robust Visual Watermarking","created":"2026-05-16","cited_by_count":1,"area":null},{"id":"2105.14710","title":"Robustifying $\\ell_\\infty$ Adversarial Training to the Union of Perturbation Models","created":"2021-05-31","cited_by_count":0,"area":null},{"id":"2107.09126","title":"Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognition","created":"2021-07-19","cited_by_count":0,"area":null},{"id":"2108.02756","title":"BOSS: Bidirectional One-Shot Synthesis of Adversarial Examples","created":"2021-08-05","cited_by_count":0,"area":null},{"id":"2209.08682","title":"Towards Robust Off-Policy Evaluation via Human Inputs","created":"2022-09-18","cited_by_count":0,"area":null},{"id":"2301.10454","title":"A Data-Centric Approach for Improving Adversarial Training Through the Lens of Out-of-Distribution Detection","created":"2023-01-25","cited_by_count":0,"area":null}],"next_cursor":"100"}