mlsanityData to 7 Oct 2026

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

arXiv 1705.07263 ↗First posted 20 May 2017cs.LG cs.CR cs.CVcited by 542

Not on the map. Why?

Cited by 33 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Neural networks are known to be vulnerable to adversarial examples: inputs that are close to natural inputs but classified incorrectly. In order to better understand the space of adversarial examples, we survey ten recent proposals that are designed for detection and compare their efficacy. We show that all can be defeated by constructing new loss functions. We conclude that adversarial examples are significantly harder to detect than previously appreciated, and the properties believed to be intrinsic to adversarial examples are in fact not. Finally, we propose several simple guidelines for evaluating future proposed defenses.

Key facts. Cited by 542 papers in the map (data through 7 Oct 2026). First posted on arXiv 20 May 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 171; 2022: 116; 2023: 87; 2024: 89; 2025: 56; 2026: 23.

542 papers.

Sort:

By area:

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  3. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  4. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  5. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  6. 2021Improving Robustness using Generated Datacited by 233
  7. 2021Trustworthy AI: From Principles to Practicescited by 206
  8. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  9. 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 200
  10. 2021Data Augmentation Can Improve Robustnesscited by 193
  11. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 144
  12. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
38 more
  1. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attackscited by 124
  2. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 113
  3. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agentscited by 112
  4. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  5. 2021Globally-Robust Neural Networkscited by 106
  6. 2021Shifts: A Dataset of Real Distributional Shift Across Multiple Large-Scale Taskscited by 100
  7. 2021Trustworthy AI: A Computational Perspectivecited by 93
  8. 2021Types of Out-of-Distribution Texts and How to Detect Themcited by 80
  9. 2021Graph Posterior Network: Bayesian Predictive Uncertainty for Node Classificationcited by 79
  10. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  11. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  12. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Roboticscited by 68
  13. 2021MT3: Meta Test-Time Training for Self-Supervised Test-Time Adaptioncited by 65
  14. 2022Evaluating the Susceptibility of Pre-Trained Language Models via Handcrafted Adversarial Examplescited by 65
  15. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  16. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  17. 2021A Dynamical System Perspective for Lipschitz Neural Networkscited by 59
  18. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
  19. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  20. 2021Robot Learning from Randomized Simulations: A Reviewcited by 56
  21. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
  22. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  23. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  24. 2024On Evaluating the Durability of Safeguards for Open-Weight LLMscited by 51
  25. 2022Predicting Out-of-Distribution Error with the Projection Normcited by 50
  26. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  27. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  28. 2025WebInject: Prompt Injection Attack to Web Agentscited by 48
  29. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
  30. 2021Fast Certified Robust Training with Short Warmupcited by 45
  31. 2021Data Poisoning Won't Save You From Facial Recognitioncited by 45
  32. 2022Discovering Bugs in Vision Models using Off-the-shelf Image Generation and Captioningcited by 45
  33. 2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
  34. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  35. 2021Neural Mean Discrepancy for Efficient Out-of-Distribution Detectioncited by 42
  36. 2021WaveGuard: Understanding and Mitigating Audio Adversarial Examplescited by 39
  37. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 39
  38. 2023Are Defenses for Graph Neural Networks Robust?cited by 38

50 most cited of 542 All 542 (JSON)