Data to 14 Oct 2026

Adversarial Examples Improve Image Recognition

arXiv 1911.09665 ↗First posted 21 Nov 2019cs.CVcited by 286

Not on the map. Why?

Abstract (arXiv)

Adversarial examples are commonly viewed as a threat to ConvNets. Here we present an opposite perspective: adversarial examples can be used to improve image recognition models if harnessed in the right manner. We propose AdvProp, an enhanced adversarial training scheme which treats adversarial examples as additional examples, to prevent overfitting. Key to our method is the usage of a separate auxiliary batch norm for adversarial examples, as they have different underlying distributions to normal examples. We show that AdvProp improves a wide range of models on various image recognition tasks and performs better when the models are bigger. For instance, by applying AdvProp to the latest EfficientNet-B7 [28] on ImageNet, we achieve significant improvements on ImageNet (+0.7%), ImageNet-C (+6.5%), ImageNet-A (+7.0%), Stylized-ImageNet (+4.8%). With an enhanced EfficientNet-B8, our method achieves the state-of-the-art 85.5% ImageNet top-1 accuracy without extra data. This result even surpasses the best model in [20] which is trained with 3.5B Instagram images (~3000X more than ImageNet) and ~9.4X more parameters. Models are available at https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet.

Key facts. Cited by 286 papers in the map (data through 14 Oct 2026). First posted on arXiv 21 Nov 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 82; 2022: 71; 2023: 73; 2024: 38; 2025: 17; 2026: 5.

286 papers.

Sort:

By area:

2021Going deeper with Image Transformerscited by 764
2024UniDepth: Universal Monocular Metric Depth Estimationcited by 382
2021Graph Contrastive Learning Automatedcited by 287
2021When Vision Transformers Outperform ResNets without Pre-training or Strong Data Augmentationscited by 260
2022Omnivore: A Single Model for Many Visual Modalitiescited by 215
2021VOLO: Vision Outlooker for Visual Recognitioncited by 165
2021Adversarial Reciprocal Points Learning for Open Set Recognitioncited by 153
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2022Revisiting Weakly Supervised Pre-Training of Visual Perception Modelscited by 116
2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 111
2022Improving Generalization in Federated Learning by Seeking Flat Minimacited by 98
2021AugMax: Adversarial Composition of Random Augmentations for Robust Trainingcited by 90

38 more

2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
2022Conv2Former: A Simple Transformer-Style ConvNet for Visual Recognitioncited by 81
2021A Simple Baseline for Semi-supervised Semantic Segmentation with Strong Data Augmentationcited by 79
2022Improving Vision Transformers by Revisiting High-frequency Componentscited by 76
2021Adversarial VQA: A New Benchmark for Evaluating the Robustness of VQA Modelscited by 75
2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 74
2023iDisc: Internal Discretization for Monocular Depth Estimationcited by 73
2021On the effectiveness of adversarial training against common corruptionscited by 71
2021Improved OOD Generalization via Adversarial Training and Pre-trainingcited by 66
2023Graph Mixture of Experts: Learning on Large-Scale Graphs with Explicit Diversity Modelingcited by 64
2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 59
2022Harmonizing the object recognition strategies of deep neural networks with humanscited by 59
2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 59
2021ST3D++: Denoised Self-training for Unsupervised Domain Adaptation on 3D Object Detectioncited by 57
2022LMPriors: Pre-Trained Language Models as Task-Specific Priorscited by 56
2023StyleAdv: Meta Style Adversarial Training for Cross-Domain Few-Shot Learningcited by 53
2021Adversarial Robustness under Long-Tailed Distributioncited by 50
2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
2022Aug-NeRF: Training Stronger Neural Radiance Fields with Triple-Level Physically-Grounded Augmentationscited by 46
2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
2021Rethinking "Batch" in BatchNormcited by 45
2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
2021Robust and Accurate Object Detection via Adversarial Learningcited by 42
2021Bag of Tricks for Node Classification with Graph Neural Networkscited by 40
2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
2021Pyramid Adversarial Training Improves ViT Performancecited by 39
2022Robust Calibration with Multi-domain Temperature Scalingcited by 39
2021CM-NAS: Cross-Modality Neural Architecture Search for Visible-Infrared Person Re-Identificationcited by 38
2023GenDet: Towards Good Generalizations for AI-Generated Image Detectioncited by 36
2023What Can We Learn From The Selective Prediction And Uncertainty Estimation Performance Of 523 Imagenet Classifierscited by 35
2021Analyzing Overfitting under Class Imbalance in Neural Networks for Image Segmentationcited by 34
2023COCO-O: A Benchmark for Object Detectors under Natural Distribution Shiftscited by 34
2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
2021Direct Differentiable Augmentation Searchcited by 28
2021JEM++: Improved Techniques for Training JEMcited by 28
2022Context-Aware Robust Fine-Tuningcited by 28

50 most cited of 286 All 286 (JSON)