mlsanityData to 14 Oct 2026

Natural Adversarial Examples

arXiv 1907.07174 ↗First posted 16 Jul 2019cs.LG cs.CV stat.MLcited by 1,408

Not on the map. Why?

Cited by 327 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We introduce two challenging datasets that reliably cause machine learning model performance to substantially degrade. The datasets are collected with a simple adversarial filtration technique to create datasets with limited spurious cues. Our datasets' real-world, unmodified examples transfer to various unseen models reliably, demonstrating that computer vision models have shared weaknesses. The first dataset is called ImageNet-A and is like the ImageNet test set, but it is far more challenging for existing models. We also curate an adversarial out-of-distribution detection dataset called ImageNet-O, which is the first out-of-distribution detection dataset created for ImageNet models. On ImageNet-A a DenseNet-121 obtains around 2% accuracy, an accuracy drop of approximately 90%, and its out-of-distribution detection performance on ImageNet-O is near random chance levels. We find that existing data augmentation techniques hardly boost performance, and using other public training datasets provides improvements that are limited. However, we find that improvements to computer vision architectures provide a promising path towards robust models.

Key facts. Cited by 1,408 papers in the map (data through 14 Oct 2026). First posted on arXiv 16 Jul 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2020: 1; 2021: 112; 2022: 218; 2023: 280; 2024: 336; 2025: 273; 2026: 188.

1,408 papers.

Sort:

By area:

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,974
  3. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
  4. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  5. 2021Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervisioncited by 3,864
  6. 2022A ConvNet for the 2020scited by 3,579
  7. 2023InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Taskscited by 2,565
  8. 2021Learning to Prompt for Vision-Language Modelscited by 2,281
  9. 2022Conditional Prompt Learning for Vision-Language Modelscited by 1,433
  10. 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,396
  11. 2022CoCa: Contrastive Captioners are Image-Text Foundation Modelscited by 1,274
  12. 2022Reproducible scaling laws for contrastive language-image learningcited by 1,173
38 more
  1. 2022Editing Models with Task Arithmeticcited by 1,120
  2. 2021CLIP-Adapter: Better Vision-Language Models with Feature Adapterscited by 1,026
  3. 2021iBOT: Image BERT Pre-Training with Online Tokenizercited by 903
  4. 2023EVA-CLIP: Improved Training Techniques for CLIP at Scalecited by 798
  5. 2021Robust fine-tuning of zero-shot modelscited by 797
  6. 2022PaLI: A Jointly-Scaled Multilingual Language-Image Modelcited by 766
  7. 2021Domain Generalization: A Surveycited by 764
  8. 2022Fine-Tuning can Distort Pretrained Features and Underperform Out-of-Distributioncited by 739
  9. 2023Scaling Vision Transformers to 22 Billion Parameterscited by 694
  10. 2022EVA: Exploring the Limits of Masked Visual Representation Learning at Scalecited by 691
  11. 2022MaPLe: Multi-modal Prompt Learningcited by 687
  12. 2023DataComp: In search of the next generation of multimodal datasetscited by 644
  13. 2021Merging Models with Fisher-Weighted Averagingcited by 621
  14. 2021LiT: Zero-Shot Transfer with Locked-image text Tuningcited by 577
  15. 2021Towards Out-Of-Distribution Generalization: A Surveycited by 436
  16. 2023Symbolic Discovery of Optimization Algorithmscited by 434
  17. 2022ViM: Out-Of-Distribution with Virtual-logit Matchingcited by 405
  18. 2021Revisiting the Calibration of Modern Neural Networkscited by 390
  19. 2022Test-Time Prompt Tuning for Zero-Shot Generalization in Vision-Language Modelscited by 382
  20. 2023EVA-02: A Visual Representation for Neon Genesiscited by 381
  21. 2021MEMO: Test Time Robustness via Adaptation and Augmentationcited by 377
  22. 2022Tip-Adapter: Training-free Adaption of CLIP for Few-shot Classificationcited by 362
  23. 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
  24. 2021Open-Set Recognition: a Good Closed-Set Classifier is All You Need?cited by 353
  25. 2022Prompt-aligned Gradient for Prompt Tuningcited by 341
  26. 2025Perception Encoder: The best visual embeddings are not at the output of the networkcited by 326
  27. 2023Your Diffusion Model is Secretly a Zero-Shot Classifiercited by 306
  28. 2022BEiT v2: Masked Image Modeling with Vector-Quantized Visual Tokenizerscited by 303
  29. 2023SemDeDup: Data-efficient learning at web-scale through semantic deduplicationcited by 303
  30. 2022Masked Siamese Networks for Label-Efficient Learningcited by 302
  31. 2024Long-CLIP: Unlocking the Long-Text Capability of CLIPcited by 300
  32. 2022Scaling & Shifting Your Features: A New Baseline for Efficient Model Tuningcited by 294
  33. 2021Unsolved Problems in ML Safetycited by 292
  34. 2022MultiMAE: Multi-modal Multi-task Masked Autoencoderscited by 291
  35. 2022Matryoshka Representation Learningcited by 282
  36. 2023Self-regulating Prompts: Foundational Model Adaptation without Forgettingcited by 272
  37. 2022OpenOOD: Benchmarking Generalized Out-of-Distribution Detectioncited by 268
  38. 2021Global Filter Networks for Image Classificationcited by 260

50 most cited of 1,408 All 1,408 (JSON)