Data to 7 Oct 2026

Adversarial Training for Free!

arXiv 1904.12843 ↗First posted 29 Apr 2019cs.LG cs.CR cs.CVcited by 638

Not on the map. Why?

Abstract (arXiv)

Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters. Our "free" adversarial training algorithm achieves comparable robustness to PGD adversarial training on the CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks. The code is available at https://github.com/ashafahi/free_adv_train.

Key facts. Cited by 638 papers in the map (data through 7 Oct 2026). First posted on arXiv 29 Apr 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 157; 2022: 149; 2023: 118; 2024: 108; 2025: 65; 2026: 41.

638 papers.

Sort:

By area:

2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
2021Robust fine-tuning of zero-shot modelscited by 785
2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
2021When Vision Transformers Outperform ResNets without Pre-training or Strong Data Augmentationscited by 259
2024Rethinking Machine Unlearning for Large Language Modelscited by 247
2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
2021Are Transformers More Robust Than CNNs?cited by 187
2021GPT3Mix: Leveraging Large-scale Language Models for Text Augmentationcited by 185
2023LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examplescited by 177

38 more

2021The Values Encoded in Machine Learning Researchcited by 172
2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
2021A Survey on Data Augmentation for Text Classificationcited by 111
2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
2022Out-Of-Distribution Generalization on Graphs: A Surveycited by 97
2021Trustworthy AI: A Computational Perspectivecited by 93
2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
2023Tackling the Curse of Dimensionality with Physics-Informed Neural Networkscited by 78
2021When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?cited by 76
2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 75
2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
2021On the effectiveness of adversarial training against common corruptionscited by 71
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
2022A Light Recipe to Train Robust Vision Transformerscited by 64
2021HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noisecited by 61
2024GraphCLIP: Enhancing Transferability in Graph Foundation Models for Text-Attributed Graphscited by 58
2021Exploring Memorization in Adversarial Trainingcited by 55
2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
2023Generative Pre-trained Transformer: A Comprehensive Review on Enabling Technologies, Potential Applications, Emerging Challenges, and Future Directionscited by 55
2021Adversarial Robustness under Long-Tailed Distributioncited by 50
2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
2022AdvDO: Realistic Adversarial Attacks for Trajectory Predictioncited by 48
2024Pre-trained Model Guided Fine-Tuning for Zero-Shot Adversarial Robustnesscited by 48
2021Calibration and Consistency of Adversarial Surrogate Lossescited by 47
2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 42
2021Subspace Adversarial Trainingcited by 41
2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
2021Adversarial Robustness with Semi-Infinite Constrained Learningcited by 39
2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39

50 most cited of 638 All 638 (JSON)