mlsanityData to 14 Oct 2026

Adversarial Examples Are a Natural Consequence of Test Error in Noise

arXiv 1901.10513 ↗First posted 29 Jan 2019cs.LG cs.CV stat.MLcited by 114

Not on the map. Why?

Abstract (arXiv)

Over the last few years, the phenomenon of adversarial examples --- maliciously constructed inputs that fool trained machine learning models --- has captured the attention of the research community, especially when the adversary is restricted to small modifications of a correctly handled input. Less surprisingly, image classifiers also lack human-level performance on randomly corrupted images, such as images with additive Gaussian noise. In this paper we provide both empirical and theoretical evidence that these are two manifestations of the same underlying phenomenon, establishing close connections between the adversarial robustness and corruption robustness research programs. This suggests that improving adversarial robustness should go hand in hand with improving performance in the presence of more general and realistic image corruptions. Based on our results we recommend that future adversarial defenses consider evaluating the robustness of their methods to distributional shift with benchmarks such as Imagenet-C.

Key facts. Cited by 114 papers in the map (data through 14 Oct 2026). First posted on arXiv 29 Jan 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 39; 2022: 27; 2023: 22; 2024: 15; 2025: 6; 2026: 5.

114 papers.

Sort:

By area:

  1. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  2. 2021The Values Encoded in Machine Learning Researchcited by 172
  3. 20223D Common Corruptions and Data Augmentationcited by 119
  4. 2021AugMax: Adversarial Composition of Random Augmentations for Robust Trainingcited by 90
  5. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  6. 2021Test-Time Adaptation to Distribution Shift by Confidence Maximization and Input Transformationcited by 68
  7. 2021On Generating Transferable Targeted Perturbationscited by 65
  8. 2021Editing a classifier by rewriting its prediction rulescited by 65
  9. 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 43
  10. 2022Multi-Objective Hyperparameter Optimization in Machine Learning -- An Overviewcited by 37
  11. 2021Improving robustness against common corruptions with frequency biased modelscited by 34
  12. 2021Benchmarking the Robustness of Spatial-Temporal Models Against Corruptionscited by 34
38 more
  1. 20213DB: A Framework for Debugging Computer Vision Modelscited by 31
  2. 2021Enhancing Adversarial Robustness via Test-time Transformation Ensemblingcited by 27
  3. 2022MaxStyle: Adversarial Style Composition for Robust Medical Image Segmentationcited by 27
  4. 2023Semantic Image Segmentation: Two Decades of Researchcited by 27
  5. 2021Differentiable sampling of molecular geometries with uncertainty-based adversarial attackscited by 25
  6. 2021Robustness via Cross-Domain Ensemblescited by 23
  7. 2023Improving Generalization of Adversarial Training via Robust Critical Fine-Tuningcited by 23
  8. 2021Reliable and Trustworthy Machine Learning for Health Using Dataset Shift Detectioncited by 21
  9. 2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 20
  10. 2021Unsupervised Domain Adaptation for Semantic Image Segmentation: a Comprehensive Surveycited by 19
  11. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  12. 2021Membership Inference Attacks are Easier on Difficult Problemscited by 17
  13. 2024CTBENCH: A Library and Benchmark for Certified Trainingcited by 14
  14. 2021Combining Diverse Feature Priorscited by 12
  15. 2025Uncertainty Quantification with the Empirical Neural Tangent Kernelcited by 11
  16. 2021DeepAdversaries: Examining the Robustness of Deep Learning Models for Galaxy Morphology Classificationcited by 10
  17. 2021Improving Model Robustness by Adaptively Correcting Perturbation Levels with Active Queriescited by 9
  18. 2021Training on Test Data with Bayesian Adaptation for Covariate Shiftcited by 8
  19. 2023DeepAstroUDA: Semi-Supervised Universal Domain Adaptation for Cross-Survey Galaxy Morphology Classification and Anomaly Detectioncited by 8
  20. 2023Learning Provably Robust Estimators for Inverse Problems via Jitteringcited by 8
  21. 2022Fourier-Based Augmentations for Improved Robustness and Uncertainty Calibrationcited by 7
  22. 2021Certification of embedded systems based on Machine Learning: A surveycited by 6
  23. 2022MIAShield: Defending Membership Inference Attacks via Preemptive Exclusion of Memberscited by 6
  24. 2023Data Optimization in Deep Learning: A Surveycited by 6
  25. 2025On the Importance of Gaussianizing Representationscited by 6
  26. 2022Robust Prototypical Few-Shot Organ Segmentation with Regularized Neural-ODEscited by 5
  27. 2022Revisiting Outer Optimization in Adversarial Trainingcited by 5
  28. 2022What does a deep neural network confidently perceive? The effective dimension of high certainty class manifolds and their low confidence boundariescited by 5
  29. 2022On the Connection between Invariant Learning and Adversarial Training for Out-of-Distribution Generalizationcited by 5
  30. 2021Robustness in Compressed Neural Networks for Object Detectioncited by 4
  31. 2021Regional Adversarial Training for Better Robust Generalizationcited by 4
  32. 2021Improved Robustness of Vision Transformer via PreLayerNorm in Patch Embeddingcited by 4
  33. 2022Label-only Model Inversion Attack: The Attack that Requires the Least Informationcited by 4
  34. 2022Bounding generalization error with input compression: An empirical study with infinite-width networkscited by 4
  35. 2023Investigating the Corruption Robustness of Image Classifiers with Random Lp-norm Corruptionscited by 4
  36. 2023OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shiftcited by 4
  37. 2022A New Approach to Improve Learning-based Deepfake Detection in Realistic Conditionscited by 3
  38. 2022VITA: A Multi-Source Vicinal Transfer Augmentation Method for Out-of-Distribution Generalizationcited by 3

50 most cited of 114 All 114 (JSON)