Data to 14 Oct 2026

PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples

arXiv 1710.10766 ↗First posted 30 Oct 2017cs.LGcited by 244

Not on the map. Why?

Cited by 33 in Diffusion models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Adversarial perturbations of normal images are usually imperceptible to humans, but they can seriously confuse state-of-the-art machine learning models. What makes them so special in the eyes of image classifiers? In this paper, we show empirically that adversarial examples mainly lie in the low probability regions of the training distribution, regardless of attack types and targeted models. Using statistical hypothesis testing, we find that modern neural density models are surprisingly good at detecting imperceptible image perturbations. Based on this discovery, we devised PixelDefend, a new approach that purifies a maliciously perturbed image by moving it back towards the distribution seen in the training data. The purified image is then run through an unmodified classifier, making our method agnostic to both the classifier and the attacking method. As a result, PixelDefend can be used to protect already deployed models and be combined with other model-specific defenses. Experiments show that our method greatly improves resilience across a wide variety of state-of-the-art attacking methods, increasing accuracy on the strongest attack from 63% to 84% for Fashion MNIST and from 32% to 70% for CIFAR-10.

Key facts. Cited by 244 papers in the map (data through 14 Oct 2026). First posted on arXiv 30 Oct 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 65; 2022: 58; 2023: 51; 2024: 37; 2025: 24; 2026: 9.

244 papers.

Sort:

By area:

2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,114
2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 672
2022Diffusion Models for Adversarial Purificationcited by 476
2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
2021Adversarial purification with Score-based generative modelscited by 134
2022Guided Diffusion Model for Adversarial Purificationcited by 92
2022GMMSeg: Gaussian Mixture based Generative Semantic Segmentation Modelscited by 87
2023Self-Supervised Video Forensics by Audio-Visual Anomaly Detectioncited by 85
2023Robust Classification via a Single Diffusion Modelcited by 79
2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 52

38 more

2023Diffusion Models With Learned Adaptive Noisecited by 51
2021Online Adversarial Purification based on Self-Supervisioncited by 46
2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
2021Subspace Adversarial Trainingcited by 41
2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
2021Biometrics: Trust, but Verifycited by 39
2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
2022Guided Diffusion Model for Adversarial Purification from Random Noisecited by 35
2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 35
2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
2022DensePure: Understanding Diffusion Models towards Adversarial Robustnesscited by 33
2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
2022Towards Efficient Adversarial Training on Vision Transformerscited by 30
2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
2021AdvRush: Searching for Adversarially Robust Neural Architecturescited by 28
2022Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systemscited by 27
2022Fast Adversarial Training with Adaptive Step Sizecited by 25
2022Threat Model-Agnostic Adversarial Defense using Diffusion Modelscited by 24
2021Towards Robust Neural Networks via Close-loop Controlcited by 23
2022On the Limitations of Stochastic Pre-processing Defensescited by 21
2023Neural Diffusion Modelscited by 21
2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 20
2022Defensive Patches for Robust Recognition in the Physical Worldcited by 20
2021Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamicscited by 19
2022Textual Manifold-based Defense Against Natural Language Adversarial Examplescited by 19
2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
2022Adversarial Rademacher Complexity of Deep Neural Networkscited by 18
2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
2024Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalizationcited by 15
2021Attack as Defense: Characterizing Adversarial Examples using Robustnesscited by 14
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 14
2021A Person Re-identification Data Augmentation Method with Adversarial Defense Effectcited by 13
2021Adversarial Visual Robustness by Causal Interventioncited by 13

50 most cited of 244 All 244 (JSON)