mlsanityData to 7 Oct 2026

Adversarial Examples Are Not Bugs, They Are Features

arXiv 1905.02175 ↗First posted 6 May 2019stat.ML cs.CR cs.CVcited by 950

Not on the map. Why?

Cited by 45 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Adversarial examples have attracted significant attention in machine learning, but the reasons for their existence and pervasiveness remain unclear. We demonstrate that adversarial examples can be directly attributed to the presence of non-robust features: features derived from patterns in the data distribution that are highly predictive, yet brittle and incomprehensible to humans. After capturing these features within a theoretical framework, we establish their widespread existence in standard datasets. Finally, we present a simple setting where we can rigorously tie the phenomena we observe in practice to a misalignment between the (human-specified) notion of robustness and the inherent geometry of the data.

Key facts. Cited by 950 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 209; 2022: 217; 2023: 172; 2024: 154; 2025: 107; 2026: 91.

950 papers.

Sort:

By area:

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2021Generalized Out-of-Distribution Detection: A Surveycited by 796
  4. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 415
  5. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  6. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  7. 2023TRAK: Attributing Model Behavior at Scalecited by 273
  8. 2021Dataset Distillation with Infinitely Wide Convolutional Networkscited by 215
  9. 2023On the Robustness of ChatGPT: An Adversarial and Out-of-distribution Perspectivecited by 208
  10. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  11. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  12. 2022Datamodels: Predicting Predictions from Training Datacited by 186
38 more
  1. 2023OpenOOD v1.5: Enhanced Benchmark for Out-of-Distribution Detectioncited by 178
  2. 2023LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examplescited by 177
  3. 2021The Values Encoded in Machine Learning Researchcited by 172
  4. 2021Maximum Entropy RL (Provably) Solves Some Robust RL Problemscited by 169
  5. 2021A Unified Survey on Anomaly, Novelty, Open-Set, and Out-of-Distribution Detection: Solutions and Future Challengescited by 154
  6. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  7. 2024CycleResearcher: Improving Automated Research via Automated Reviewcited by 142
  8. 2021Anti-Adversarially Manipulated Attributions for Weakly and Semi-Supervised Semantic Segmentationcited by 134
  9. 2021Fit without fear: remarkable mathematical phenomena of deep learning through the prism of interpolationcited by 130
  10. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  11. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  12. 2022Toward Transparent AI: A Survey on Interpreting the Inner Structures of Deep Neural Networkscited by 126
  13. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  14. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  15. 2021Goal Misgeneralization in Deep Reinforcement Learningcited by 122
  16. 2021Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyondcited by 116
  17. 2021Adversarial Examples Make Strong Poisonscited by 115
  18. 2021Can contrastive learning avoid shortcut solutions?cited by 114
  19. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  20. 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
  21. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  22. 2023Revisiting Out-of-distribution Robustness in NLP: Benchmark, Analysis, and LLMs Evaluationscited by 96
  23. 2021Counterfactual Zero-Shot and Open-Set Visual Recognitioncited by 95
  24. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  25. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  26. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  27. 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 89
  28. 2024What is Your Data Worth to GPT? LLM-Scale Data Valuation with Influence Functionscited by 88
  29. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  30. 2022Shortcut Learning of Large Language Models in Natural Language Understandingcited by 83
  31. 2021Leveraging Sparse Linear Layers for Debuggable Deep Networkscited by 82
  32. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  33. 2021Causal Attention for Unbiased Visual Recognitioncited by 80
  34. 2021Towards Interpreting and Mitigating Shortcut Learning Behavior of NLU Modelscited by 78
  35. 2024Distilling Diffusion Models into Conditional GANscited by 78
  36. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  37. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  38. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73

50 most cited of 950 All 950 (JSON)