mlsanityData to 7 Oct 2026

Adversarially Robust Generalization Requires More Data

arXiv 1804.11285 ↗First posted 30 Apr 2018cs.LG cs.NE stat.MLcited by 318

Not on the map. Why?

Abstract (arXiv)

Machine learning models are often susceptible to adversarial perturbations of their inputs. Even small perturbations can cause state-of-the-art classifiers with high "standard" accuracy to produce an incorrect prediction with high confidence. To better understand this phenomenon, we study adversarially robust learning from the viewpoint of generalization. We show that already in a simple natural data model, the sample complexity of robust learning can be significantly larger than that of "standard" learning. This gap is information theoretic and holds irrespective of the training algorithm or the model family. We complement our theoretical results with experiments on popular image classification datasets and show that a similar gap exists here as well. We postulate that the difficulty of training robust classifiers stems, at least partially, from this inherently larger sample complexity.

Key facts. Cited by 318 papers in the map (data through 7 Oct 2026). First posted on arXiv 30 Apr 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 75; 2022: 81; 2023: 64; 2024: 49; 2025: 33; 2026: 16.

318 papers.

Sort:

By area:

  1. 2021Pre-Trained Models: Past, Present and Futurecited by 319
  2. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  3. 2021Accuracy on the Line: On the Strong Correlation Between Out-of-Distribution and In-Distribution Generalizationcited by 248
  4. 2022CelebV-HQ: A Large-Scale Video Facial Attributes Datasetcited by 246
  5. 2021Improving Robustness using Generated Datacited by 233
  6. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  7. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  8. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  9. 2021The Values Encoded in Machine Learning Researchcited by 172
  10. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  11. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  12. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
38 more
  1. 2022CommonsenseQA 2.0: Exposing the Limits of AI through Gamificationcited by 108
  2. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
  3. 2021Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domaincited by 70
  4. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  5. 2021When and How Mixup Improves Calibrationcited by 59
  6. 2021A Survey On Universal Adversarial Attackcited by 59
  7. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  8. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  9. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
  10. 2021Exploring Memorization in Adversarial Trainingcited by 55
  11. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  12. 2021Adversarial Robustness under Long-Tailed Distributioncited by 50
  13. 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
  14. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  15. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
  16. 2022Aug-NeRF: Training Stronger Neural Radiance Fields with Triple-Level Physically-Grounded Augmentationscited by 46
  17. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  18. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  19. 2023Data Augmentation Alone Can Improve Adversarial Trainingcited by 43
  20. 2021Consistency Regularization for Adversarial Robustnesscited by 42
  21. 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
  22. 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studiescited by 38
  23. 2021Adversarial Training Helps Transfer Learning via Better Representationscited by 36
  24. 2022Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneckcited by 30
  25. 2022Stability Analysis and Generalization Bounds of Adversarial Trainingcited by 30
  26. 2022A Survey of Mix-based Data Augmentation: Taxonomy, Methods, Applications, and Explainabilitycited by 30
  27. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  28. 2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
  29. 2023Randomized Adversarial Training via Taylor Expansioncited by 28
  30. 2021Noisy Feature Mixupcited by 27
  31. 2022Gradient Methods Provably Converge to Non-Robust Networkscited by 27
  32. 2024MedFuzz: Exploring the Robustness of Large Language Models in Medical Question Answeringcited by 26
  33. 2021Data-Efficient GAN Training Beyond (Just) Augmentations: A Lottery Ticket Perspectivecited by 25
  34. 2021On the Existence of the Adversarial Bayes Classifier (Extended Version)cited by 25
  35. 2022Robust Weight Perturbation for Adversarial Trainingcited by 25
  36. 2023Toward Understanding Generative Data Augmentationcited by 25
  37. 2021Adversarially Robust Learning with Unknown Perturbation Setscited by 24
  38. 2021Removing Undesirable Feature Contributions Using Out-of-Distribution Datacited by 23

50 most cited of 318 All 318 (JSON)