# On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses

arXiv: https://arxiv.org/abs/1804.03286 · HTML: https://mlsanity.com/paper/1804.03286/

## Key facts

- Cited by 40 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Apr 2018.

## Built on by (most cited first, 30 of 40)

- [Recent Advances in Adversarial Training for Adversarial Robustness](https://mlsanity.com/paper/2102.01356/) (2021)
- [Relating Adversarially Robust Generalization to Flat Minima](https://mlsanity.com/paper/2104.04448/) (2021)
- [Intriguing Properties of Input-dependent Randomized Smoothing](https://mlsanity.com/paper/2110.05365/) (2021)
- [Towards Viewpoint-Invariant Visual Recognition via Adversarial Training](https://mlsanity.com/paper/2307.10235/) (2023)
- [Attack to Fool and Explain Deep Networks](https://mlsanity.com/paper/2106.10606/) (2021)
- [Towards Understanding Adversarial Robustness of Optical Flow Networks](https://mlsanity.com/paper/2103.16255/) (2021)
- [On Robustness of Neural Semantic Parsers](https://mlsanity.com/paper/2102.01563/) (2021)
- [Improving Robustness by Enhancing Weak Subnets](https://mlsanity.com/paper/2201.12765/) (2022)
- [Responsible and Regulatory Conform Machine Learning for Medicine: A Survey of Challenges and Solutions](https://mlsanity.com/paper/2107.09546/) (2021)
- [Integer-arithmetic-only Certified Robustness for Quantized Neural Networks](https://mlsanity.com/paper/2108.09413/) (2021)
- [Improving Viewpoint Robustness for Visual Recognition via Adversarial Training](https://mlsanity.com/paper/2307.11528/) (2023)
- [Towards the Worst-case Robustness of Large Language Models](https://mlsanity.com/paper/2501.19040/) (2025)
- [Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks](https://mlsanity.com/paper/2106.07141/) (2021)
- [FedCCL: Federated Dual-Clustered Feature Contrast Under Domain Heterogeneity](https://mlsanity.com/paper/2404.09259/) (2024)
- [Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networks](https://mlsanity.com/paper/2112.14232/) (2021)
- [Reverse Engineering ℓp attacks: A block-sparse optimization approach with recovery guarantees](https://mlsanity.com/paper/2203.04886/) (2022)
- [General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignments](https://mlsanity.com/paper/2212.05387/) (2022)
- [Improving deep learning with prior knowledge and cognitive models: A survey on enhancing explainability, adversarial robustness and zero-shot learning](https://mlsanity.com/paper/2403.07078/) (2024)
- [Logit Calibration and Feature Contrast for Robust Federated Learning on Non-IID Data](https://mlsanity.com/paper/2404.06776/) (2024)
- [AMA-LSTM: Pioneering Robust and Fair Financial Audio Analysis for Stock Volatility Prediction](https://mlsanity.com/paper/2407.18324/) (2024)
- [Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training](https://mlsanity.com/paper/2106.05453/) (2021)
- [Mitigating Black-Box Adversarial Attacks via Output Noise Perturbation](https://mlsanity.com/paper/2109.15160/) (2021)
- [AdAUC: End-to-end Adversarial AUC Optimization Against Long-tail Problems](https://mlsanity.com/paper/2206.12169/) (2022)
- [PEARL: Preprocessing Enhanced Adversarial Robust Learning of Image Deraining for Semantic Segmentation](https://mlsanity.com/paper/2305.15709/) (2023)
- [Learning Defense Transformers for Counterattacking Adversarial Examples](https://mlsanity.com/paper/2103.07595/) (2021)
- [Simpler Certified Radius Maximization by Propagating Covariances](https://mlsanity.com/paper/2104.05888/) (2021)
- [Saliency Diversified Deep Ensemble for Robustness to Adversaries](https://mlsanity.com/paper/2112.03615/) (2021)
- [Adversarial Attacks on Image Classification Models: Analysis and Defense](https://mlsanity.com/paper/2312.16880/) (2023)
- [Federated Hybrid Training and Self-Adversarial Distillation: Towards Robust Edge Networks](https://mlsanity.com/paper/2412.19354/) (2024)
- [Resilience from Diversity: Population-based approach to harden models against adversarial attacks](https://mlsanity.com/paper/2111.10272/) (2021)

## Abstract (arXiv)

Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.