mlsanityData to 7 Oct 2026

Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?

arXiv 1910.08640 ↗First posted 18 Oct 2019cs.LG cs.CV stat.MLcited by 42

Not on the map. Why?

Abstract (arXiv)

For a standard convolutional neural network, optimizing over the input pixels to maximize the score of some target class will generally produce a grainy-looking version of the original image. However, Santurkar et al. (2019) demonstrated that for adversarially-trained neural networks, this optimization produces images that uncannily resemble the target class. In this paper, we show that these "perceptually-aligned gradients" also occur under randomized smoothing, an alternative means of constructing adversarially-robust classifiers. Our finding supports the hypothesis that perceptually-aligned gradients may be a general property of robust classifiers. We hope that our results will inspire research aimed at explaining this link between perceptually-aligned gradients and adversarial robustness.

Key facts. Cited by 42 papers in the map (data through 7 Oct 2026). First posted on arXiv 18 Oct 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 14; 2022: 10; 2023: 7; 2024: 5; 2025: 3; 2026: 3.

42 papers.

Sort:

By area:

  1. 2021Partial success in closing the gap between human and machine visioncited by 185
  2. 2022Toward Transparent AI: A Survey on Interpreting the Inner Structures of Deep Neural Networkscited by 126
  3. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  4. 2021When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?cited by 76
  5. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  6. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
  7. 2022Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidancecited by 33
  8. 2022Distilling Robust and Non-Robust Features in Adversarial Examples by Information Bottleneckcited by 30
  9. 2021Adversarial Training is Not Ready for Robot Learningcited by 20
  10. 2023A Closer Look at Model Adaptation using Feature Distortion and Simplicity Biascited by 20
  11. 2023Which Models have Perceptually-Aligned Gradients? An Explanation via Off-Manifold Robustnesscited by 20
  12. 2022Plug-In Inversion: Model-Agnostic Inversion for Vision with Data Augmentationscited by 18
30 more
  1. 2022The Manifold Hypothesis for Gradient-Based Explanationscited by 15
  2. 2022Do Perceptually Aligned Gradients Imply Adversarial Robustness?cited by 15
  3. 2022A Unified Contrastive Energy-based Model for Understanding the Generative Ability of Adversarial Trainingcited by 13
  4. 2021Combining Diverse Feature Priorscited by 12
  5. 2023CLIPAG: Towards Generator-Free Text-to-Image Generationcited by 12
  6. 2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
  7. 2021BIGRoC: Boosting Image Generation via a Robust Classifiercited by 9
  8. 2021Impact of Spatial Frequency Based Constraints on Adversarial Robustnesscited by 8
  9. 2021Adversarial Perturbations Are Not So Weird: Entanglement of Robust and Non-Robust Features in Neural Network Classifierscited by 7
  10. 2021Inverting Adversarially Robust Networks for Image Synthesiscited by 6
  11. 2022MAGIC: Mask-Guided Image Synthesis by Inverting a Quasi-Robust Classifiercited by 6
  12. 2024Characterizing Model Robustness via Natural Input Gradientscited by 6
  13. 2023DiffAug: A Diffuse-and-Denoise Augmentation for Training Robust Classifierscited by 5
  14. 2024Persistent Classification: A New Approach to Stability of Data and Adversarial Examplescited by 3
  15. 2021Energy Attack: On Transferring Adversarial Examplescited by 2
  16. 2021Do Invariances in Deep Neural Networks Align with Human Perception?cited by 2
  17. 2023Exploring the Connection between Robust and Generative Modelscited by 2
  18. 2024Theoretical Understanding of Learning from Adversarial Perturbationscited by 2
  19. 2024Enhancing Consistency-Based Image Generation via Adversarialy-Trained Classification and Energy-Based Discriminationcited by 2
  20. 2025Adversarially Pretrained Transformers May Be Universally Robust In-Context Learnerscited by 2
  21. 2025Informative Post-Hoc Explanations Only Exist for Simple Functionscited by 2
  22. 2026Counterfactual Explanations on Robust Perceptual Geodesicscited by 2
  23. 2021Bio-inspired Robustness: A Reviewcited by 1
  24. 2021Improving the Behaviour of Vision Transformers with Token-consistent Stochastic Layerscited by 0
  25. 2022Adversarially robust segmentation models learn perceptually-aligned gradientscited by 0
  26. 2023Training Image Derivatives: Increased Accuracy and Universal Robustnesscited by 0
  27. 2024Towards White Box Deep Learningcited by 0
  28. 2025Pulling Back the Curtain on Deep Networkscited by 0
  29. 2026Adversarially Robust PAC Learning with Optimal VC Ratescited by 0
  30. 2026Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoderscited by 0