Data to 13 Oct 2026

Disentangling Adversarial Robustness and Generalization

arXiv 1812.00740 ↗First posted 3 Dec 2018cs.CV cs.CR cs.LGcited by 172

Not on the map. Why?

Abstract (arXiv)

Obtaining deep networks that are robust against adversarial examples and generalize well is an open problem. A recent hypothesis even states that both robust and accurate models are impossible, i.e., adversarial robustness and generalization are conflicting goals. In an effort to clarify the relationship between robustness and generalization, we assume an underlying, low-dimensional data manifold and show that: 1. regular adversarial examples leave the manifold; 2. adversarial examples constrained to the manifold, i.e., on-manifold adversarial examples, exist; 3. on-manifold adversarial examples are generalization errors, and on-manifold adversarial training boosts generalization; 4. regular robustness and generalization are not necessarily contradicting goals. These assumptions imply that both robust and accurate models are possible. However, different models (architectures, training strategies etc.) can exhibit different robustness and generalization characteristics. To confirm our claims, we present extensive experiments on synthetic data (with known manifold) as well as on EMNIST, Fashion-MNIST and CelebA.

Key facts. Cited by 172 papers in the map (data through 13 Oct 2026). First posted on arXiv 3 Dec 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2021: 46; 2022: 35; 2023: 28; 2024: 26; 2025: 18; 2026: 19.

172 papers.

Sort:

By area:

2021The Intrinsic Dimension of Images and Its Impact on Learningcited by 312
2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 278
2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2021Adversarial Examples Make Strong Poisonscited by 119
2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 110
2021On the effectiveness of adversarial training against common corruptionscited by 71
2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
2022Aug-NeRF: Training Stronger Neural Radiance Fields with Triple-Level Physically-Grounded Augmentationscited by 46
2021Online Adversarial Purification based on Self-Supervisioncited by 45

38 more

2021Noisy Recurrent Neural Networkscited by 42
2021Uncertainty-guided Model Generalization to Unseen Domainscited by 41
2021The Dimpled Manifold Model of Adversarial Examples in Machine Learningcited by 41
2021Generalization of Neural Combinatorial Solvers Through the Lens of Adversarial Robustnesscited by 35
2024A review on data-driven constitutive laws for solidscited by 35
2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
2021Attacking Adversarial Attacks as A Defensecited by 31
2021Data-Efficient GAN Training Beyond (Just) Augmentations: A Lottery Ticket Perspectivecited by 25
2021BASAR:Black-box Attack on Skeletal Action Recognitioncited by 25
2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
2021Uncertainty-Aware Reliable Text Classificationcited by 23
2022Exploring the Relationship between Architecture and Adversarially Robust Generalizationcited by 23
2024TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Modelscited by 23
2023Adversarial Bayesian Augmentation for Single-Source Domain Generalizationcited by 22
2021Adversarial Training is Not Ready for Robot Learningcited by 20
2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
2024Can Biases in ImageNet Models Explain Generalization?cited by 20
2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 19
2022Textual Manifold-based Defense Against Natural Language Adversarial Examplescited by 19
2021GAN-based Data Augmentation for Chest X-ray Classificationcited by 18
2021Out-of-Domain Generalization from a Single Source: An Uncertainty Quantification Approachcited by 18
2021Adversarial Examples can be Effective Data Augmentation for Unsupervised Machine Learningcited by 16
2022The Manifold Hypothesis for Gradient-Based Explanationscited by 16
2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
2025Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detectioncited by 16
2022Why adversarial training can hurt robust accuracycited by 14
2023Adversarial Training Should Be Cast as a Non-Zero-Sum Gamecited by 13
2023Mitigating Accuracy-Robustness Trade-off via Balanced Multi-Teacher Adversarial Distillationcited by 13
2022Understanding Adversarial Robustness Against On-manifold Adversarial Examplescited by 12
2021Adversarial Feature Augmentation and Normalization for Visual Recognitioncited by 11
2022Holistic Adversarial Robustness of Deep Learning Modelscited by 11
2022Out-of-Distribution Detection with Reconstruction Error and Typicality-based Penaltycited by 11
2023Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustnesscited by 11
2021Interpolated Joint Space Adversarial Training for Robust and Generalizable Defensescited by 10
2023Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classificationcited by 10

50 most cited of 172 All 172 (JSON)