mlsanityData to 7 Oct 2026

Are adversarial examples inevitable?

arXiv 1809.02104 ↗First posted 6 Sep 2018cs.LG cs.CV stat.MLcited by 113

Not on the map. Why?

Abstract (arXiv)

A wide range of defenses have been proposed to harden neural networks against adversarial attacks. However, a pattern has emerged in which the majority of adversarial defenses are quickly broken by new attacks. Given the lack of success at generating robust defenses, we are led to ask a fundamental question: Are adversarial attacks inevitable? This paper analyzes adversarial examples from a theoretical perspective, and identifies fundamental bounds on the susceptibility of a classifier to adversarial attacks. We show that, for certain classes of problems, adversarial examples are inescapable. Using experiments, we explore the implications of theoretical guarantees for real-world problems and discuss how factors such as dimensionality and image complexity limit a classifier's robustness against adversarial examples.

Key facts. Cited by 113 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Sep 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 28; 2022: 26; 2023: 30; 2024: 15; 2025: 9; 2026: 5.

113 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2021A Survey On Universal Adversarial Attackcited by 59
  3. 2022Can Neural Nets Learn the Same Model Twice? Investigating Reproducibility and Double Descent from the Decision Boundary Perspectivecited by 57
  4. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
  5. 2021Do Input Gradients Highlight Discriminative Features?cited by 52
  6. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
  7. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  8. 2022Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneckcited by 30
  9. 2022Gradient Methods Provably Converge to Non-Robust Networkscited by 27
  10. 2022Why Robust Generalization in Deep Learning is Difficult: Perspective of Expressive Powercited by 23
  11. 2023The Double-Edged Sword of Implicit Bias: Generalization vs. Robustness in ReLU Networkscited by 23
  12. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMscited by 21
38 more
  1. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  2. 2023Demystifying Causal Features on Adversarial Examples and Causal Inoculation for Robust Network by Adversarial Instrumental Variable Regressioncited by 18
  3. 2022Reverse Engineering of Imperceptible Adversarial Image Perturbationscited by 17
  4. 2022Improving the Adversarial Robustness of NLP Models by Information Bottleneckcited by 17
  5. 2021Shift Invariance Can Reduce Adversarial Robustnesscited by 16
  6. 2021The mathematics of adversarial attacks in AI -- Why deep learning is unstable despite the existence of stable neural networkscited by 16
  7. 2023Adversarial Examples Are Not Real Featurescited by 16
  8. 2021Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attackcited by 15
  9. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  10. 2022Evolution of Neural Tangent Kernels under Benign and Adversarial Trainingcited by 14
  11. 2025Position: Adversarial ML for LLMs Is Not Making Any Progresscited by 14
  12. 2022Adversarial Examples in Random Neural Networks with General Activationscited by 13
  13. 2025Adversarial Examples Are Not Bugs, They Are Superpositioncited by 13
  14. 2021The Feasibility and Inevitability of Stealth Attackscited by 12
  15. 2022Adversarial robustness of sparse local Lipschitz predictorscited by 11
  16. 2023Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustnesscited by 11
  17. 2021Deep Learning Generalization and the Convex Hull of Training Setscited by 10
  18. 2021Understanding Generalization in Adversarial Training via the Bias-Variance Decompositioncited by 10
  19. 2022On the (Non-)Robustness of Two-Layer Neural Networks in Different Learning Regimescited by 10
  20. 2021Increasing the Confidence of Deep Neural Networks by Coverage Analysiscited by 9
  21. 2021SoK: Machine Learning Governancecited by 9
  22. 2023It Is All About Data: A Survey on the Effects of Data on Adversarial Robustnesscited by 9
  23. 2023Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspacescited by 8
  24. 2023Learning Provably Robust Estimators for Inverse Problems via Jitteringcited by 8
  25. 2021Adversarial Perturbations Are Not So Weird: Entanglement of Robust and Non-Robust Features in Neural Network Classifierscited by 7
  26. 2023Understanding Noise-Augmented Training for Randomized Smoothingcited by 7
  27. 2023Adversarial Ink: Componentwise Backward Error Attacks on Deep Learningcited by 7
  28. 2024The Surprising Harmfulness of Benign Overfitting for Adversarial Robustnesscited by 7
  29. 2021Who's Afraid of Adversarial Transferability?cited by 6
  30. 2022Adversarial Parameter Attack on Deep Neural Networkscited by 6
  31. 2023Deep Reinforcement Learning for Autonomous Cyber Defence: A Surveycited by 6
  32. 2024On the Computability of Robust PAC Learningcited by 6
  33. 2021Robust Classification Under ℓ0 Attack for the Gaussian Mixture Modelcited by 5
  34. 2022Decision boundaries and convex hulls in the feature space that deep learning functions learn from imagescited by 5
  35. 2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5
  36. 2023How many dimensions are required to find an adversarial example?cited by 5
  37. 2023The Boundaries of Verifiable Accuracy, Robustness, and Generalisation in Deep Learningcited by 5
  38. 2023Asymmetric Bias in Text-to-Image Generation with Adversarial Attackscited by 5

50 most cited of 113 All 113 (JSON)