mlsanityData to 7 Oct 2026

Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

arXiv 1704.01155 ↗First posted 4 Apr 2017cs.CV cs.CR cs.LGcited by 484

Not on the map. Why?

Cited by 23 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Although deep neural networks (DNNs) have achieved great success in many tasks, they can often be fooled by adversarial examples that are generated by adding small but purposeful distortions to natural examples. Previous studies to defend against adversarial examples mostly focused on refining the DNN models, but have either shown limited success or required expensive computation. We propose a new strategy, feature squeezing, that can be used to harden DNN models by detecting adversarial examples. Feature squeezing reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. By comparing a DNN model's prediction on the original input with that on squeezed inputs, feature squeezing detects adversarial examples with high accuracy and few false positives. This paper explores two feature squeezing methods: reducing the color bit depth of each pixel and spatial smoothing. These simple strategies are inexpensive and complementary to other defenses, and can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks.

Key facts. Cited by 484 papers in the map (data through 7 Oct 2026). First posted on arXiv 4 Apr 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 107; 2022: 85; 2023: 84; 2024: 83; 2025: 86; 2026: 39.

484 papers.

Sort:

By area:

  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  2. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  3. 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
  4. 2021Data Collection and Quality Challenges in Deep Learning: A Data-Centric AI Perspectivecited by 116
  5. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  6. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  7. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  8. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  9. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  10. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
  11. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  12. 2023Content-based Unrestricted Adversarial Attackcited by 73
38 more
  1. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Roboticscited by 68
  2. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  3. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  4. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  5. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  6. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  7. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  8. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  9. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
  10. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  11. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  12. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  13. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  14. 2022NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Modelscited by 47
  15. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
  16. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  17. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  18. 2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
  19. 2022Enhancing Adversarial Training with Second-Order Statistics of Weightscited by 42
  20. 2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
  21. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
  22. 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
  23. 2021LiBRe: A Practical Bayesian Approach to Adversarial Detectioncited by 40
  24. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  25. 2021WaveGuard: Understanding and Mitigating Audio Adversarial Examplescited by 39
  26. 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 38
  27. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 36
  28. 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
  29. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  30. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  31. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
  32. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  33. 2022Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimationcited by 32
  34. 2023A Trip Towards Fairness: Bias and De-Biasing in Large Language Modelscited by 32
  35. 2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
  36. 2021Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defensescited by 29
  37. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
  38. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29

50 most cited of 484 All 484 (JSON)