# MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples

arXiv: https://arxiv.org/abs/1711.08478 · HTML: https://mlsanity.com/paper/1711.08478/

## Key facts

- Cited by 46 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Nov 2017.

## Built on by (most cited first, 30 of 46)

- [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021)
- [Adversarial Example Detection for DNN Models: A Review and Experimental Comparison](https://mlsanity.com/paper/2105.00203/) (2021)
- [Physical Adversarial Attacks on an Aerial Imagery Object Detector](https://mlsanity.com/paper/2108.11765/) (2021)
- [Towards Defending against Adversarial Examples via Attack-Invariant Features](https://mlsanity.com/paper/2106.05036/) (2021)
- [Removing Adversarial Noise in Class Activation Feature Space](https://mlsanity.com/paper/2104.09197/) (2021)
- [Attack to Fool and Explain Deep Networks](https://mlsanity.com/paper/2106.10606/) (2021)
- [SoK: Anti-Facial Recognition Technology](https://mlsanity.com/paper/2112.04558/) (2021)
- [Attack as Defense: Characterizing Adversarial Examples using Robustness](https://mlsanity.com/paper/2103.07633/) (2021)
- [Improving Robustness by Enhancing Weak Subnets](https://mlsanity.com/paper/2201.12765/) (2022)
- [What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction](https://mlsanity.com/paper/2201.09650/) (2022)
- [Increasing the Confidence of Deep Neural Networks by Coverage Analysis](https://mlsanity.com/paper/2101.12100/) (2021)
- [Revisiting Model's Uncertainty and Confidences for Adversarial Example Detection](https://mlsanity.com/paper/2103.05354/) (2021)
- [Modeling Adversarial Noise for Adversarial Training](https://mlsanity.com/paper/2109.09901/) (2021)
- [Learning Provably Robust Estimators for Inverse Problems via Jittering](https://mlsanity.com/paper/2307.12822/) (2023)
- [Self-Supervised Adversarial Example Detection by Disentangled Representation](https://mlsanity.com/paper/2105.03689/) (2021)
- [Position: Machine Learning Conferences Should Establish a "Refutations and Critiques" Track](https://mlsanity.com/paper/2506.19882/) (2025)
- [Evaluating the Robustness of Trigger Set-Based Watermarks Embedded in Deep Neural Networks](https://mlsanity.com/paper/2106.10147/) (2021)
- [Deep-Attack over the Deep Reinforcement Learning](https://mlsanity.com/paper/2205.00807/) (2022)
- [Unfolding Local Growth Rate Estimates for (Almost) Perfect Adversarial Detection](https://mlsanity.com/paper/2212.06776/) (2022)
- [Revisiting the Trade-off between Accuracy and Robustness via Weight Distribution of Filters](https://mlsanity.com/paper/2306.03430/) (2023)
- [A Comprehensive Survey on the Security of Smart Grid: Challenges, Mitigations, and Future Research Opportunities](https://mlsanity.com/paper/2407.07966/) (2024)
- [Position: Certified Robustness Does Not (Yet) Imply Model Security](https://mlsanity.com/paper/2506.13024/) (2025)
- [Online Adversarial Attacks](https://mlsanity.com/paper/2103.02014/) (2021)
- [Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training](https://mlsanity.com/paper/2106.05453/) (2021)
- [Adversarial Robustness in Deep Learning: Attacks on Fragile Neurons](https://mlsanity.com/paper/2201.12347/) (2022)
- [Individual Fairness in Bayesian Neural Networks](https://mlsanity.com/paper/2304.10828/) (2023)
- ["What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models](https://mlsanity.com/paper/2102.05104/) (2021)
- [Computational Asymmetries in Robust Classification](https://mlsanity.com/paper/2306.14326/) (2023)
- [Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN](https://mlsanity.com/paper/2103.04513/) (2021)
- [Delving into the pixels of adversarial samples](https://mlsanity.com/paper/2106.10996/) (2021)

## Abstract (arXiv)

MagNet and "Efficient Defenses..." were recently proposed as a defense to adversarial examples. We find that we can construct adversarial examples that defeat these defenses with only a slight increase in distortion.