mlsanityData to 7 Oct 2026

Accurate, reliable and fast robustness evaluation

arXiv 1907.01003 ↗First posted 1 Jul 2019stat.ML cs.CR cs.CVcited by 43

Not on the map. Why?

Abstract (arXiv)

Throughout the past five years, the susceptibility of neural networks to minimal adversarial perturbations has moved from a peculiar phenomenon to a core issue in Deep Learning. Despite much attention, however, progress towards more robust models is significantly impaired by the difficulty of evaluating the robustness of neural network models. Today's methods are either fast but brittle (gradient-based attacks), or they are fairly reliable but slow (score- and decision-based attacks). We here develop a new set of gradient-based adversarial attacks which (a) are more reliable in the face of gradient-masking than other gradient-based attacks, (b) perform better and are more query efficient than current state-of-the-art gradient-based attacks, (c) can be flexibly adapted to a wide range of adversarial criteria and (d) require virtually no hyperparameter tuning. These findings are carefully validated across a diverse set of six different models and hold for L0, L1, L2 and Linf in both targeted as well as untargeted scenarios. Implementations will soon be available in all major toolboxes (Foolbox, CleverHans and ART). We hope that this class of attacks will make robustness evaluations easier and more reliable, thus contributing to more signal in the search for more robust machine learning models.

Key facts. Cited by 43 papers in the map (data through 7 Oct 2026). First posted on arXiv 1 Jul 2019.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 16; 2022: 9; 2023: 8; 2024: 9; 2025: 1.

43 papers.

Sort:

  1. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  2. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  3. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
  4. 2022A Unified Wasserstein Distributional Robustness Framework for Adversarial Trainingcited by 36
  5. 2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
  6. 2021Exploring Misclassifications of Robust Neural Networks to Enhance Adversarial Attackscited by 33
  7. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
  8. 2022Proximal Splitting Adversarial Attacks for Semantic Segmentationcited by 23
  9. 2022Unrestricted Black-box Adversarial Attack Using GAN with Limited Queriescited by 18
  10. 2022LLMEffiChecker: Understanding and Testing Efficiency Degradation of Large Language Modelscited by 16
  11. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  12. 2021Identifying Untrustworthy Predictions in Neural Networks by Geometric Gradient Analysiscited by 13
31 more
  1. 2022Increasing Confidence in Adversarial Robustness Evaluationscited by 12
  2. 2024Visual Robustness Benchmark for Visual Question Answering (VQA)cited by 12
  3. 2022Global-Local Regularization Via Distributional Robustnesscited by 11
  4. 2024Adversarial Pruning: A Survey and Benchmark of Pruning Methods for Adversarial Robustnesscited by 10
  5. 2021PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attackcited by 8
  6. 2021Performance Evaluation of Adversarial Attacks: Discrepancies and Solutionscited by 7
  7. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
  8. 2021Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attackscited by 6
  9. 2021Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNscited by 5
  10. 2022Towards Out-of-Distribution Adversarial Robustnesscited by 5
  11. 2023Balance is Essence: Accelerating Sparse Training via Adaptive Gradient Correctioncited by 5
  12. 2023Users are the North Star for AI Transparencycited by 5
  13. 2021Pruning in the Face of Adversariescited by 4
  14. 2021EG-Booster: Explanation-Guided Booster of ML Evasion Attackscited by 3
  15. 2021Enhancing Robustness of Neural Networks through Fourier Stabilizationcited by 2
  16. 2021PopSkipJump: Decision-Based Attack for Probabilistic Classifierscited by 2
  17. 2022Testing robustness of predictions of trained classifiers against naturally occurring perturbationscited by 2
  18. 2023Generating Adversarial Examples with Task Oriented Multi-Objective Optimizationcited by 2
  19. 2023Computational Asymmetries in Robust Classificationcited by 2
  20. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  21. 2025Evaluating the Evaluators: Trust in Adversarial Robustness Testscited by 2
  22. 2021Bio-inspired Robustness: A Reviewcited by 1
  23. 2021Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attackscited by 1
  24. 2023ExploreADV: Towards exploratory attack for Neural Networkscited by 1
  25. 2024Assessing the Uncertainty and Robustness of the Laptop Refurbishing Softwarecited by 1
  26. 2024Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attackscited by 1
  27. 2023CGDTest: A Constrained Gradient Descent Algorithm for Testing Neural Networkscited by 0
  28. 2023Cooperation or Competition: Avoiding Player Domination for Multi-Target Robustness via Adaptive Budgetscited by 0
  29. 2023Adversarial attacks on hybrid classical-quantum Deep Learning models for Histopathological Cancer Detectioncited by 0
  30. 2024Generating Minimalist Adversarial Perturbations to Test Object-Detection Models: An Adaptive Multi-Metric Evolutionary Search Approachcited by 0
  31. 2024A Novel Bifurcation Method for Observation Perturbation Attacks on Reinforcement Learning Agents: Load Altering Attacks on a Cyber Physical Power Systemcited by 0