mlsanityData to 7 Oct 2026

Robustness May Be at Odds with Accuracy

arXiv 1805.12152 ↗First posted 30 May 2018stat.ML cs.CV cs.LGcited by 873

Not on the map. Why?

Cited by 21 in Diffusion models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We show that there may exist an inherent tension between the goal of adversarial robustness and that of standard generalization. Specifically, training robust models may not only be more resource-consuming, but also lead to a reduction of standard accuracy. We demonstrate that this trade-off between the standard accuracy of a model and its robustness to adversarial perturbations provably exists in a fairly simple and natural setting. These findings also corroborate a similar phenomenon observed empirically in more complex settings. Further, we argue that this phenomenon is a consequence of robust classifiers learning fundamentally different feature representations than standard classifiers. These differences, in particular, seem to result in unexpected benefits: the representations learned by robust models tend to align better with salient data characteristics and human perception.

Key facts. Cited by 873 papers in the map (data through 7 Oct 2026). First posted on arXiv 30 May 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 209; 2022: 205; 2023: 180; 2024: 127; 2025: 94; 2026: 58.

873 papers.

Sort:

By area:

  1. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,422
  2. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  3. 2022Test-Time Prompt Tuning for Zero-Shot Generalization in Vision-Language Modelscited by 379
  4. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  5. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  6. 2021Improving Robustness using Generated Datacited by 233
  7. 2021Trustworthy AI: From Principles to Practicescited by 206
  8. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  9. 2021Anti-Adversarially Manipulated Attributions for Weakly and Semi-Supervised Semantic Segmentationcited by 134
  10. 2021PixMix: Dreamlike Pictures Comprehensively Improve Safety Measurescited by 131
  11. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  12. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 128
38 more
  1. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2022Toward Transparent AI: A Survey on Interpreting the Inner Structures of Deep Neural Networkscited by 126
  4. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
  5. 2021Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyondcited by 116
  6. 2021Can contrastive learning avoid shortcut solutions?cited by 114
  7. 2021Salient ImageNet: How to discover spurious features in Deep Learning?cited by 114
  8. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  9. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  10. 2021Trustworthy AI: A Computational Perspectivecited by 93
  11. 2021AugMax: Adversarial Composition of Random Augmentations for Robust Trainingcited by 89
  12. 2022B-cos Networks: Alignment is All We Need for Interpretabilitycited by 88
  13. 2022The Unreasonable Effectiveness of Random Pruning: Return of the Most Naive Baseline for Sparse Trainingcited by 85
  14. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  15. 2021Leveraging Sparse Linear Layers for Debuggable Deep Networkscited by 82
  16. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  17. 2023Robust Classification via a Single Diffusion Modelcited by 79
  18. 2021Identifying and Mitigating Spurious Correlations for Improving Robustness in NLP Modelscited by 76
  19. 2021Can Subnetwork Structure be the Key to Out-of-Distribution Generalization?cited by 75
  20. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  21. 2021On the geometry of generalization and memorization in deep neural networkscited by 71
  22. 2021Skew Orthogonal Convolutionscited by 67
  23. 2022The Effects of Regularization and Data Augmentation are Class Dependentcited by 67
  24. 2022Probable Domain Generalization via Quantile Risk Minimizationcited by 66
  25. 2021This Looks Like That... Does it? Shortcomings of Latent Space Prototype Interpretability in Deep Networkscited by 65
  26. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  27. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  28. 2025Universal Sparse Autoencoders: Interpretable Cross-Model Concept Alignmentcited by 62
  29. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  30. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  31. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
  32. 2021Person Re-identification Method Based on Color Attack and Joint Defencecited by 56
  33. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 56
  34. 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
  35. 2021Unleashing the Power of Contrastive Self-Supervised Visual Models via Contrast-Regularized Fine-Tuningcited by 50
  36. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  37. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  38. 2024Deep Networks Always Grok and Here is Whycited by 49

50 most cited of 873 All 873 (JSON)