# On the Sensitivity of Adversarial Robustness to Input Data Distributions

arXiv: https://arxiv.org/abs/1902.08336 · HTML: https://mlsanity.com/paper/1902.08336/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Feb 2019.

## Built on by (most cited first, 20 of 20)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Improving Adversarial Robustness via Mutual Information Estimation](https://mlsanity.com/paper/2207.12203/) (2022)
- [An Analytic Solution to Covariance Propagation in Neural Networks](https://mlsanity.com/paper/2403.16163/) (2024)
- [It Is All About Data: A Survey on the Effects of Data on Adversarial Robustness](https://mlsanity.com/paper/2303.09767/) (2023)
- [Modeling Adversarial Noise for Adversarial Training](https://mlsanity.com/paper/2109.09901/) (2021)
- [A Comprehensive Guide to Explainable AI: From Classical Models to LLMs](https://mlsanity.com/paper/2412.00800/) (2024)
- [Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training](https://mlsanity.com/paper/2103.15385/) (2021)
- [Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training](https://mlsanity.com/paper/2106.05453/) (2021)
- [Quantifying and Localizing Usable Information Leakage from Neural Network Gradients](https://mlsanity.com/paper/2105.13929/) (2021)
- [Robustness as an Emergent Property of Task Performance](https://mlsanity.com/paper/2602.03344/) (2026)
- [The Effects of Image Distribution and Task on Adversarial Robustness](https://mlsanity.com/paper/2102.10534/) (2021)
- [Shadows Aren't So Dangerous After All: A Fast and Robust Defense Against Shadow-Based Adversarial Attacks](https://mlsanity.com/paper/2208.09285/) (2022)
- [Adversarial training with informed data selection](https://mlsanity.com/paper/2301.04472/) (2023)
- [Can overfitted deep neural networks in adversarial training generalize? -- An approximation viewpoint](https://mlsanity.com/paper/2401.13624/) (2024)
- [The Impact of Scaling Training Data on Adversarial Robustness](https://mlsanity.com/paper/2509.25927/) (2025)
- [HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks](https://mlsanity.com/paper/2106.05825/) (2021)
- [On the Properties of Adversarially-Trained CNNs](https://mlsanity.com/paper/2203.09243/) (2022)
- [Advancing Adversarial Robustness Through Adversarial Logit Update](https://mlsanity.com/paper/2308.15072/) (2023)
- [Adversarial Purification and Fine-tuning for Robust UDC Image Restoration](https://mlsanity.com/paper/2402.13629/) (2024)
- [SOLAR: Switchable Output Layer for Accuracy and Robustness in Once-for-All Training](https://mlsanity.com/paper/2509.16833/) (2025)

## Abstract (arXiv)

Neural networks are vulnerable to small adversarial perturbations. Existing literature largely focused on understanding and mitigating the vulnerability of learned models. In this paper, we demonstrate an intriguing phenomenon about the most popular robust training method in the literature, adversarial training: Adversarial robustness, unlike clean accuracy, is sensitive to the input data distribution. Even a semantics-preserving transformations on the input data distribution can cause a significantly different robustness for the adversarial trained model that is both trained and evaluated on the new distribution. Our discovery of such sensitivity on data distribution is based on a study which disentangles the behaviors of clean accuracy and robust accuracy of the Bayes classifier. Empirical investigations further confirm our finding. We construct semantically-identical variants for MNIST and CIFAR10 respectively, and show that standardly trained models achieve comparable clean accuracies on them, but adversarially trained models achieve significantly different robustness accuracies. This counter-intuitive phenomenon indicates that input data distribution alone can affect the adversarial robustness of trained neural networks, not necessarily the tasks themselves. Lastly, we discuss the practical implications on evaluating adversarial robustness, and make initial attempts to understand this complex phenomenon.