mlsanityData to 7 Oct 2026

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning

arXiv 1712.03141 ↗First posted 8 Dec 2017cs.CV cs.CR cs.GTcited by 411

Not on the map. Why?

Cited by 30 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Learning-based pattern classifiers, including deep networks, have shown impressive performance in several application domains, ranging from computer vision to cybersecurity. However, it has also been shown that adversarial input perturbations carefully crafted either at training or at test time can easily subvert their predictions. The vulnerability of machine learning to such wild patterns (also referred to as adversarial examples), along with the design of suitable countermeasures, have been investigated in the research field of adversarial machine learning. In this work, we provide a thorough overview of the evolution of this research area over the last ten years and beyond, starting from pioneering, earlier work on the security of non-deep learning algorithms up to more recent work aimed to understand the security properties of deep learning algorithms, in the context of computer vision and cybersecurity tasks. We report interesting connections between these apparently-different lines of work, highlighting common misconceptions related to the security evaluation of machine-learning algorithms. We review the main threat models and attacks defined to this end, and discuss the main limitations of current work, along with the corresponding future challenges towards the design of more secure learning algorithms.

Key facts. Cited by 411 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 Dec 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2019: 1; 2020: 0; 2021: 100; 2022: 87; 2023: 71; 2024: 64; 2025: 49; 2026: 39.

411 papers.

Sort:

By area:

  1. 2021Robust fine-tuning of zero-shot modelscited by 785
  2. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  3. 2021Accuracy on the Line: On the Strong Correlation Between Out-of-Distribution and In-Distribution Generalizationcited by 248
  4. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  5. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  6. 2021AdaMatch: A Unified Approach to Semi-Supervised Learning and Domain Adaptationcited by 104
  7. 2021Model-Based Domain Generalizationcited by 103
  8. 2022Quality Not Quantity: On the Interaction between Dataset Design and Robustness of CLIPcited by 97
  9. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  10. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  11. 2021Proof-of-Learning: Definitions and Practicecited by 81
  12. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
38 more
  1. 2021The Evolution of Out-of-Distribution Robustness Throughout Fine-Tuningcited by 74
  2. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
  3. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  4. 2019Policy Poisoning in Batch Reinforcement Learning and Controlcited by 70
  5. 2021Bad Characters: Imperceptible NLP Attackscited by 69
  6. 2022Probable Domain Generalization via Quantile Risk Minimizationcited by 66
  7. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  8. 2021Availability Attacks Create Shortcutscited by 60
  9. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  10. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  11. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  12. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  13. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  14. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  15. 2023Adversarial attacks and defenses in explainable artificial intelligence: A surveycited by 47
  16. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  17. 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 42
  18. 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 40
  19. 2023Neither hype nor gloom do DNNs justicecited by 40
  20. 2022Experimental quantum adversarial learning with programmable superconducting qubitscited by 38
  21. 2021The Threat of Offensive AI to Organizationscited by 37
  22. 2021Adversarial Training Helps Transfer Learning via Better Representationscited by 36
  23. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  24. 2021Recent advances for quantum classifierscited by 35
  25. 2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 35
  26. 2021Pseudo-labeling for Scalable 3D Object Detectioncited by 32
  27. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learningcited by 32
  28. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 32
  29. 2022Federated Learning for Privacy Preservation in Smart Healthcare Systems: A Comprehensive Surveycited by 31
  30. 2021De-Pois: An Attack-Agnostic Defense against Data Poisoning Attackscited by 29
  31. 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
  32. 2023Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directionscited by 28
  33. 2021Bayesian Inference with Certifiable Adversarial Robustnesscited by 26
  34. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  35. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  36. 2023On the Connection between Pre-training Data Diversity and Fine-tuning Robustnesscited by 25
  37. 2022Architectural Backdoors in Neural Networkscited by 24
  38. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23

50 most cited of 411 All 411 (JSON)