mlsanityData to 7 Oct 2026

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

arXiv 1802.00420 ↗First posted 1 Feb 2018cs.LG cs.AI cs.CRcited by 1,259

Not on the map. Why?

Cited by 46 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We identify obfuscated gradients, a kind of gradient masking, as a phenomenon that leads to a false sense of security in defenses against adversarial examples. While defenses that cause obfuscated gradients appear to defeat iterative optimization-based attacks, we find defenses relying on this effect can be circumvented. We describe characteristic behaviors of defenses exhibiting the effect, and for each of the three types of obfuscated gradients we discover, we develop attack techniques to overcome it. In a case study, examining non-certified white-box-secure defenses at ICLR 2018, we find obfuscated gradients are a common occurrence, with 7 of 9 defenses relying on obfuscated gradients. Our new attacks successfully circumvent 6 completely, and 1 partially, in the original threat model each paper considers.

Key facts. Cited by 1,259 papers in the map (data through 7 Oct 2026). First posted on arXiv 1 Feb 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2018: 1; 2019: 0; 2020: 0; 2021: 342; 2022: 276; 2023: 216; 2024: 183; 2025: 127; 2026: 114.

1,259 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  3. 2022Diffusion Models for Adversarial Purificationcited by 469
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  5. 2018Scalable agent alignment via reward modeling: a research directioncited by 438
  6. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  7. 2021A Field Guide to Federated Optimizationcited by 312
  8. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  9. 2021Unsolved Problems in ML Safetycited by 291
  10. 2024Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoderscited by 283
  11. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  12. 2024Rethinking Machine Unlearning for Large Language Modelscited by 247
38 more
  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  2. 2021Improving Robustness using Generated Datacited by 233
  3. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  4. 2021Data Augmentation Can Improve Robustnesscited by 193
  5. 2021The Values Encoded in Machine Learning Researchcited by 172
  6. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  8. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
  9. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Promptscited by 161
  10. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  11. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  12. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 144
  13. 2021Adversarial purification with Score-based generative modelscited by 132
  14. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  15. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  16. 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
  17. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
  18. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
  19. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  20. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agentscited by 112
  21. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  22. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  23. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  24. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 102
  25. 2021Towards Robust and Reliable Algorithmic Recoursecited by 101
  26. 2022Guided Diffusion Model for Adversarial Purificationcited by 90
  27. 2022On Adversarial Robustness of Trajectory Prediction for Autonomous Vehiclescited by 89
  28. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 89
  29. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  30. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  31. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  32. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  33. 2023Robust Classification via a Single Diffusion Modelcited by 79
  34. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  35. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  36. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  37. 2021When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?cited by 76
  38. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 75

50 most cited of 1,259 All 1,259 (JSON)