Data to 7 Oct 2026

Adversarial Logit Pairing

arXiv 1803.06373 ↗First posted 16 Mar 2018cs.LG stat.MLcited by 224

Not on the map. Why?

Abstract (arXiv)

In this paper, we develop improved techniques for defending against adversarial examples at scale. First, we implement the state of the art version of adversarial training at unprecedented scale on ImageNet and investigate whether it remains effective in this setting - an important open scientific question (Athalye et al., 2018). Next, we introduce enhanced defenses using a technique we call logit pairing, a method that encourages logits for pairs of examples to be similar. When applied to clean examples and their adversarial counterparts, logit pairing improves accuracy on adversarial examples over vanilla adversarial training; we also find that logit pairing on clean examples only is competitive with adversarial training in terms of accuracy on two datasets. Finally, we show that adversarial logit pairing achieves the state of the art defense on ImageNet against PGD white box attacks, with an accuracy improvement from 1.5% to 27.9%. Adversarial logit pairing also successfully damages the current state of the art defense against black box attacks on ImageNet (Tramer et al., 2018), dropping its accuracy from 66.6% to 47.1%. With this new accuracy drop, adversarial logit pairing ties with Tramer et al.(2018) for the state of the art on black box attacks on ImageNet.

Key facts. Cited by 224 papers in the map (data through 7 Oct 2026). First posted on arXiv 16 Mar 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 71; 2022: 57; 2023: 42; 2024: 34; 2025: 18; 2026: 2.

224 papers.

Sort:

By area:

2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
2021Data Augmentation Can Improve Robustnesscited by 193
2021The Values Encoded in Machine Learning Researchcited by 172
2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
2022Style-Hallucinated Dual Consistency Learning for Domain Generalized Semantic Segmentationcited by 88
2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
2021When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?cited by 76
2021On the effectiveness of adversarial training against common corruptionscited by 71

38 more

2021Improved OOD Generalization via Adversarial Training and Pre-trainingcited by 66
2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
2021Adversarial Robustness under Long-Tailed Distributioncited by 50
2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
2021Online Adversarial Purification based on Self-Supervisioncited by 45
2021Consistency Regularization for Adversarial Robustnesscited by 42
2022Enhancing Adversarial Training with Second-Order Statistics of Weightscited by 42
2021LiBRe: A Practical Bayesian Approach to Adversarial Detectioncited by 40
2021Understanding and Improving Robustness of Vision Transformers through Patch-based Negative Augmentationcited by 40
2021Biometrics: Trust, but Verifycited by 39
2021Adversarial Robustness with Semi-Infinite Constrained Learningcited by 39
2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
2022Probabilistically Robust Learning: Balancing Average- and Worst-case Performancecited by 36
2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 34
2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
2023Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectivescited by 30
2021AdvRush: Searching for Adversarially Robust Neural Architecturescited by 28
2021A Frequency Perspective of Adversarial Robustnesscited by 28
2023Randomized Adversarial Training via Taylor Expansioncited by 28
2022"That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attackscited by 24
2021Removing Undesirable Feature Contributions Using Out-of-Distribution Datacited by 23
2022Exploring the Relationship between Architecture and Adversarially Robust Generalizationcited by 23
2022Style-Hallucinated Dual Consistency Learning: A Unified Framework for Visual Domain Generalizationcited by 22
2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
2021CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selectioncited by 21
2021Does Robustness Improve Fairness? Approaching Fairness with Word Substitution Robustness Methods for Text Classificationcited by 20
2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
2023Delving into the Adversarial Robustness of Federated Learningcited by 19
2021On the Inherent Regularization Effects of Noise Injection During Trainingcited by 18
2022Revisiting adapters with adversarial trainingcited by 18
2022Toward Certified Robustness Against Real-World Distribution Shiftscited by 16
2023Feature Separation and Recalibration for Adversarial Robustnesscited by 16
2021Joint inference and input optimization in equilibrium networkscited by 15
2022Existence and Minimax Theorems for Adversarial Surrogate Risks in Binary Classificationcited by 15
2021Adversarial Visual Robustness by Causal Interventioncited by 13

50 most cited of 224 All 224 (JSON)