{"list":"other","total":65,"rows":[{"id":"1512.03385","title":"Deep Residual Learning for Image Recognition","created":"2015-12-10","cited_by_count":52096},{"id":"1409.1556","title":"Very Deep Convolutional Networks for Large-Scale Image Recognition","created":"2014-09-04","cited_by_count":15364},{"id":"1412.6572","title":"Explaining and Harnessing Adversarial Examples","created":"2014-12-20","cited_by_count":7364},{"id":"1608.06993","title":"Densely Connected Convolutional Networks","created":"2016-08-25","cited_by_count":6720},{"id":"1706.06083","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","created":"2017-06-19","cited_by_count":6415},{"id":"1312.6199","title":"Intriguing properties of neural networks","created":"2013-12-21","cited_by_count":5155},{"id":"2307.15043","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","created":"2023-07-27","cited_by_count":3104},{"id":"1605.07146","title":"Wide Residual Networks","created":"2016-05-23","cited_by_count":3070},{"id":"1608.04644","title":"Towards Evaluating the Robustness of Neural Networks","created":"2016-08-16","cited_by_count":2998},{"id":"1611.03530","title":"Understanding deep learning requires rethinking generalization","created":"2016-11-10","cited_by_count":1674},{"id":"2307.02483","title":"Jailbroken: How Does LLM Safety Training Fail?","created":"2023-07-05","cited_by_count":1651},{"id":"1901.08573","title":"Theoretically Principled Trade-off between Robustness and Accuracy","created":"2019-01-24","cited_by_count":1517},{"id":"2003.01690","title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","created":"2020-03-03","cited_by_count":1451},{"id":"2010.01412","title":"Sharpness-Aware Minimization for Efficiently Improving Generalization","created":"2020-10-03","cited_by_count":1417},{"id":"1609.04836","title":"On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minima","created":"2016-09-15","cited_by_count":1352},{"id":"1902.02918","title":"Certified Adversarial Robustness via Randomized Smoothing","created":"2019-02-08","cited_by_count":1340},{"id":"1803.05407","title":"Averaging Weights Leads to Wider Optima and Better Generalization","created":"2018-03-14","cited_by_count":1209},{"id":"1611.01236","title":"Adversarial Machine Learning at Scale","created":"2016-11-04","cited_by_count":936},{"id":"1805.12152","title":"Robustness May Be at Odds with Accuracy","created":"2018-05-30","cited_by_count":880},{"id":"1705.07204","title":"Ensemble Adversarial Training: Attacks and Defenses","created":"2017-05-19","cited_by_count":840},{"id":"1503.05671","title":"Optimizing Neural Networks with Kronecker-factored Approximate Curvature","created":"2015-03-19","cited_by_count":796},{"id":"1511.07528","title":"The Limitations of Deep Learning in Adversarial Settings","created":"2015-11-24","cited_by_count":790},{"id":"1912.00049","title":"Square Attack: a query-efficient black-box adversarial attack via random search","created":"2019-11-29","cited_by_count":685},{"id":"1706.08947","title":"Exploring Generalization in Deep Learning","created":"2017-06-27","cited_by_count":600},{"id":"1906.12340","title":"Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty","created":"2019-06-28","cited_by_count":514},{"id":"2002.11569","title":"Overfitting in adversarially robust deep learning","created":"2020-02-26","cited_by_count":506},{"id":"2004.09984","title":"BERT-ATTACK: Adversarial Attack Against BERT Using BERT","created":"2020-04-21","cited_by_count":491},{"id":"1703.04933","title":"Sharp Minima Can Generalize For Deep Nets","created":"2017-03-15","cited_by_count":466},{"id":"2102.08604","title":"SWAD: Domain Generalization by Seeking Flat Minima","created":"2021-02-17","cited_by_count":434},{"id":"1905.13736","title":"Unlabeled Data Improves Adversarial Robustness","created":"2019-05-31","cited_by_count":416},{"id":"1611.01838","title":"Entropy-SGD: Biasing Gradient Descent Into Wide Valleys","created":"2016-11-06","cited_by_count":359},{"id":"1906.04584","title":"Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers","created":"2019-06-09","cited_by_count":330},{"id":"1804.11285","title":"Adversarially Robust Generalization Requires More Data","created":"2018-04-30","cited_by_count":318},{"id":"2102.11600","title":"ASAM: Adaptive Sharpness-Aware Minimization for Scale-Invariant Learning of Deep Neural Networks","created":"2021-02-23","cited_by_count":293},{"id":"1710.10766","title":"PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples","created":"2017-10-30","cited_by_count":244},{"id":"2110.09468","title":"Improving Robustness using Generated Data","created":"2021-10-18","cited_by_count":234},{"id":"1802.04034","title":"Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks","created":"2018-02-12","cited_by_count":195},{"id":"1705.08475","title":"Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation","created":"2017-05-23","cited_by_count":185},{"id":"1812.00740","title":"Disentangling Adversarial Robustness and Generalization","created":"2018-12-03","cited_by_count":172},{"id":"1905.13725","title":"Are Labels Required for Improving Adversarial Robustness?","created":"2019-05-31","cited_by_count":163},{"id":"2002.10716","title":"Understanding and Mitigating the Tradeoff Between Robustness and Accuracy","created":"2020-02-25","cited_by_count":149},{"id":"2005.00060","title":"Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness","created":"2020-04-30","cited_by_count":132},{"id":"1711.01530","title":"Fisher-Rao Metric, Geometry, and Complexity of Neural Networks","created":"2017-11-05","cited_by_count":100},{"id":"2302.07011","title":"A Modern Look at the Relationship between Sharpness and Generalization","created":"2023-02-14","cited_by_count":92},{"id":"1805.04807","title":"Curriculum Adversarial Training","created":"2018-05-13","cited_by_count":89},{"id":"2001.00939","title":"Relative Flatness and Generalization","created":"2020-01-03","cited_by_count":88},{"id":"1811.11304","title":"Universal Adversarial Training","created":"2018-11-27","cited_by_count":87},{"id":"1901.04653","title":"Normalized Flat Minima: Exploring Scale Invariant Definition of Flat Minima for Neural Networks using PAC-Bayesian Analysis","created":"2019-01-15","cited_by_count":59},{"id":"2104.04448","title":"Relating Adversarially Robust Generalization to Flat Minima","created":"2021-04-09","cited_by_count":57},{"id":"2206.10654","title":"On the Maximum Hessian Eigenvalue and Generalization","created":"2022-06-21","cited_by_count":57},{"id":"2103.01208","title":"Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers","created":"2021-03-01","cited_by_count":51},{"id":"2106.10151","title":"The Dimpled Manifold Model of Adversarial Examples in Machine Learning","created":"2021-06-18","cited_by_count":41},{"id":"1901.00532","title":"Adversarial Robustness May Be at Odds With Simplicity","created":"2019-01-02","cited_by_count":39},{"id":"1804.07729","title":"ADef: an Iterative Algorithm to Construct Adversarial Deformations","created":"2018-04-20","cited_by_count":38},{"id":"1905.05186","title":"Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models","created":"2019-05-13","cited_by_count":26},{"id":"2305.05392","title":"Sharpness-Aware Minimization Alone can Improve Adversarial Robustness","created":"2023-05-09","cited_by_count":14},{"id":"1809.07802","title":"Playing the Game of Universal Adversarial Perturbations","created":"2018-09-20","cited_by_count":9},{"id":"1910.12165","title":"Adversarial Defense via Local Flatness Regularization","created":"2019-10-27","cited_by_count":9},{"id":"2502.20604","title":"Exploring the Impact of Temperature Scaling in Softmax for Classification and Adversarial Robustness","created":"2025-02-28","cited_by_count":9},{"id":"2303.00783","title":"Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspaces","created":"2023-03-01","cited_by_count":8},{"id":"2509.17738","title":"Flatness is Necessary, Neural Collapse is Not: Rethinking Generalization via Grokking","created":"2025-09-22","cited_by_count":8},{"id":"1912.00058","title":"A Reparameterization-Invariant Flatness Measure for Deep Neural Networks","created":"2019-11-29","cited_by_count":7},{"id":"2009.08435","title":"Large Norms of CNN Layers Do Not Hurt Adversarial Robustness","created":"2020-09-17","cited_by_count":7},{"id":"2403.03967","title":"Effect of Ambient-Intrinsic Dimension Gap on Adversarial Vulnerability","created":"2024-03-06","cited_by_count":5},{"id":"2203.13277","title":"A Manifold View of Adversarial Risk","created":"2022-03-24","cited_by_count":4}],"next_cursor":null}