mlsanityData to 13 Oct 2026

On Detecting Adversarial Perturbations

arXiv 1702.04267 ↗First posted 14 Feb 2017stat.ML cs.AI cs.CVcited by 232

Not on the map. Why?

Abstract (arXiv)

Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to augment deep neural networks with a small "detector" subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. Our method is orthogonal to prior work on addressing adversarial perturbations, which has mostly focused on making the classification network itself more robust. We show empirically that adversarial perturbations can be detected surprisingly well even though they are quasi-imperceptible to humans. Moreover, while the detectors have been trained to detect only a specific adversary, they generalize to similar and weaker adversaries. In addition, we propose an adversarial attack that fools both the classifier and the detector and a novel training procedure for the detector that counteracts this attack.

Key facts. Cited by 232 papers in the map (data through 13 Oct 2026). First posted on arXiv 14 Feb 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2021: 89; 2022: 44; 2023: 34; 2024: 28; 2025: 27; 2026: 10.

232 papers.

Sort:

By area:

  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 647
  2. 2021Trustworthy AI: From Principles to Practicescited by 206
  3. 2021Data Collection and Quality Challenges in Deep Learning: A Data-Centric AI Perspectivecited by 116
  4. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
  5. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  6. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  7. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  8. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 52
  9. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  10. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 48
  11. 2023Adversarial attacks and defenses in explainable artificial intelligence: A surveycited by 48
  12. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
38 more
  1. 2021Optical Adversarial Attackcited by 43
  2. 2021LiBRe: A Practical Bayesian Approach to Adversarial Detectioncited by 40
  3. 2021Biometrics: Trust, but Verifycited by 39
  4. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  5. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
  6. 2021Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descentcited by 34
  7. 2022Visual Prompting for Adversarial Robustnesscited by 34
  8. 2022Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimationcited by 32
  9. 2021SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domaincited by 30
  10. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  11. 2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
  12. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
  13. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  14. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 28
  15. 2021AdvRush: Searching for Adversarially Robust Neural Architecturescited by 28
  16. 2022Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systemscited by 27
  17. 2022Robust Models are less Over-Confidentcited by 25
  18. 2021Adversarial Attacks on Deep Models for Financial Transaction Recordscited by 24
  19. 2021Towards Robust Neural Networks via Close-loop Controlcited by 23
  20. 2021Automated Discovery of Adaptive Attacks on Adversarial Defensescited by 22
  21. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  22. 2022Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarioscited by 20
  23. 2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Modelscited by 19
  24. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  25. 2021Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devicescited by 18
  26. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
  27. 2021MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakescited by 17
  28. 2021Adversarial Robustness in Multi-Task Learning: Promises and Illusionscited by 17
  29. 2022Reverse Engineering of Imperceptible Adversarial Image Perturbationscited by 17
  30. 2021SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluationcited by 16
  31. 2021Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attackcited by 15
  32. 2021Two Coupled Rejection Metrics Can Tell Adversarial Examples Apartcited by 14
  33. 2023IPMix: Label-Preserving Data Augmentation Method for Training Robust Classifierscited by 14
  34. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  35. 2021Interpreting Attributions and Interactions of Adversarial Attackscited by 13
  36. 2023Detection and Defense of Unlearnable Examplescited by 13
  37. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 12
  38. 2022Increasing Confidence in Adversarial Robustness Evaluationscited by 12

50 most cited of 232 All 232 (JSON)