Data to 14 Oct 2026

A New Defense Against Adversarial Images: Turning a Weakness into a Strength

arXiv 1910.07629 ↗First posted 16 Oct 2019cs.LG cs.CR stat.MLcited by 49

Not on the map. Why?

Abstract (arXiv)

Natural images are virtually surrounded by low-density misclassified regions that can be efficiently discovered by gradient-guided search --- enabling the generation of adversarial images. While many techniques for detecting these attacks have been proposed, they are easily bypassed when the adversary has full knowledge of the detection mechanism and adapts the attack strategy accordingly. In this paper, we adopt a novel perspective and regard the omnipresence of adversarial perturbations as a strength rather than a weakness. We postulate that if an image has been tampered with, these adversarial directions either become harder to find with gradient methods or have substantially higher density than for natural images. We develop a practical test for this signature characteristic to successfully detect adversarial attacks, achieving unprecedented accuracy under the white-box setting where the adversary is given full knowledge of our detection mechanism.

Key facts. Cited by 49 papers in the map (data through 14 Oct 2026). First posted on arXiv 16 Oct 2019.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 18; 2022: 8; 2023: 11; 2024: 5; 2025: 7.

49 papers.

Sort:

By area:

2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 48
2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
2021Fooling LiDAR Perception via Adversarial Trajectory Perturbationcited by 25
2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
2021Automated Discovery of Adaptive Attacks on Adversarial Defensescited by 22
2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 15
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2022CADet: Fully Self-Supervised Out-Of-Distribution Detection With Contrastive Learningcited by 11
2021On the robustness of randomized classifiers to adversarial examplescited by 9

37 more

2023Probing the Purview of Neural Networks via Gradient Analysiscited by 9
2023Assessing Privacy Risks in Language Models: A Case Study on Summarization Taskscited by 8
2023Detecting Adversarial Directions in Deep Reinforcement Learning to Make Robust Decisionscited by 7
2021The art of defense: letting networks fool the attackercited by 6
2021Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attackscited by 6
2023Interpretability is a Kind of Safety: An Interpreter-based Ensemble for Adversary Defensecited by 6
2021Adversarial Training Makes Weight Loss Landscape Sharper in Logistic Regressioncited by 5
2022Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learningcited by 5
2023Test-time Detection and Repair of Adversarial Samples via Masked Autoencodercited by 4
2024The Uncanny Valley: Exploring Adversarial Robustness from a Flatness Perspectivecited by 4
2021Anomaly Detection of Adversarial Examples using Class-conditional Generative Adversarial Networkscited by 3
2022On Real-time Image Reconstruction with Neural Networks for MRI-guided Radiotherapycited by 3
2023Expecting The Unexpected: Towards Broad Out-Of-Distribution Detectioncited by 3
2024Persistent Classification: A New Approach to Stability of Data and Adversarial Examplescited by 3
2024PASA: Attack Agnostic Unsupervised Adversarial Detection using Prediction & Attribution Sensitivity Analysiscited by 3
2021BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidabilitycited by 2
2022On Trace of PGD-Like Adversarial Attackscited by 2
2023Mitigating Adversarial Attacks in Federated Learning with Trusted Execution Environmentscited by 2
2024CausAdv: A Causal-based Framework for Detecting Adversarial Examplescited by 2
2021Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attackscited by 1
2021Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attackscited by 1
2022From Environmental Sound Representation to Robustness of 2D CNN Models Against Adversarial Attackscited by 1
2023Pelta: Shielding Transformers to Mitigate Evasion Attacks in Federated Learningcited by 1
2025A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detectioncited by 1
2025On the Feasibility of Poisoning Text-to-Image AI Models via Adversarial Mislabelingcited by 1
2025Effective Code Membership Inference for Code Completion Models via Adversarial Promptscited by 1
2021Target Training Does Adversarial Training Without Adversarial Samplescited by 0
2021Improving Transformation-based Defenses against Adversarial Examples with First-order Perturbationscited by 0
2021HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attackscited by 0
2021ML-based IoT Malware Detection Under Adversarial Settings: A Systematic Evaluationcited by 0
2022HoneyModels: Machine Learning Honeypotscited by 0
2022DNNShield: Dynamic Randomized Model Sparsification, A Defense Against Adversarial Machine Learningcited by 0
2023Unsupervised Multi-Criteria Adversarial Detection in Deep Image Retrievalcited by 0
2023Boosting Adversarial Robustness using Feature Level Stochastic Smoothingcited by 0
2024Discerning the Chaos: Detecting Adversarial Perturbations while Disentangling Intentional from Unintentional Noisescited by 0
2025TRAIL: Transferable Robust Adversarial Images via Latent diffusioncited by 0
2025KoALA: KL-L0 Adversarial Detector via Label Agreementcited by 0