mlsanityData to 7 Oct 2026

Ensemble Adversarial Training: Attacks and Defenses

arXiv 1705.07204 ↗First posted 19 May 2017stat.ML cs.CR cs.LGcited by 833

Not on the map. Why?

Cited by 22 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against strong ones. As a result, we find that adversarial training remains vulnerable to black-box attacks, where we transfer perturbations computed on undefended models, as well as to a powerful novel single-step attack that escapes the non-smooth vicinity of the input data via a small random step. We further introduce Ensemble Adversarial Training, a technique that augments training data with perturbations transferred from other models. On ImageNet, Ensemble Adversarial Training yields models with strong robustness to black-box attacks. In particular, our most robust model won the first round of the NIPS 2017 competition on Defenses against Adversarial Attacks. However, subsequent work found that more elaborate black-box attacks could significantly enhance transferability and reduce the accuracy of our models.

Key facts. Cited by 833 papers in the map (data through 7 Oct 2026). First posted on arXiv 19 May 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 226; 2022: 184; 2023: 171; 2024: 132; 2025: 92; 2026: 28.

833 papers.

Sort:

By area:

  1. 2021Robust fine-tuning of zero-shot modelscited by 785
  2. 2021Unsolved Problems in ML Safetycited by 291
  3. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  4. 2023Poisoning Language Models During Instruction Tuningcited by 254
  5. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  6. 2021Improving Robustness using Generated Datacited by 233
  7. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  8. 2021Trustworthy AI: From Principles to Practicescited by 206
  9. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  10. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  11. 2021Data Augmentation Can Improve Robustnesscited by 193
  12. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
38 more
  1. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  2. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
  3. 2021Graph Unlearningcited by 129
  4. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  5. 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
  6. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  7. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  8. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  9. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  10. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  11. 2021Conservative Objective Models for Effective Offline Model-Based Optimizationcited by 87
  12. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  13. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  14. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  15. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  16. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
  17. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  18. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
  19. 2023Content-based Unrestricted Adversarial Attackcited by 73
  20. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  21. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  22. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  23. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  24. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  25. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  26. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  27. 2021Meta Gradient Adversarial Attackcited by 55
  28. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  29. 2021Membership Inference Attacks Against Recommender Systemscited by 52
  30. 2022Neuromorphic Data Augmentation for Training Spiking Neural Networkscited by 52
  31. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  32. 2022DTA: Physical Camouflage Attacks using Differentiable Transformation Networkcited by 51
  33. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  34. 2022Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Inputcited by 49
  35. 2024Vitron: A Unified Pixel-level Vision LLM for Understanding, Generating, Segmenting, Editingcited by 49
  36. 2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 48
  37. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  38. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46

50 most cited of 833 All 833 (JSON)