mlsanityData to 14 Oct 2026

On Adaptive Attacks to Adversarial Example Defenses

arXiv 2002.08347 ↗First posted 19 Feb 2020cs.LG cs.CR stat.MLcited by 555

Not on the map. Why?

Cited by 50 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that thirteen defenses recently published at ICLR, ICML and NeurIPS---and chosen for illustrative and pedagogical purposes---can be circumvented despite attempting to perform evaluations using adaptive attacks. While prior evaluation papers focused mainly on the end result---showing that a defense was ineffective---this paper focuses on laying out the methodology and the approach necessary to perform an adaptive attack. We hope that these analyses will serve as guidance on how to properly perform adaptive attacks against defenses to adversarial examples, and thus will allow the community to make further progress in building more robust models.

Key facts. Cited by 555 papers in the map (data through 14 Oct 2026). First posted on arXiv 19 Feb 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 139; 2022: 112; 2023: 98; 2024: 88; 2025: 51; 2026: 67.

555 papers.

Sort:

By area:

  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  2. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  3. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  4. 2022Diffusion Models for Adversarial Purificationcited by 476
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  6. 2023Are aligned neural networks adversarially aligned?cited by 315
  7. 2021Unsolved Problems in ML Safetycited by 292
  8. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  9. 2021Improving Robustness using Generated Datacited by 234
  10. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  11. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
  12. 2023LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examplescited by 177
38 more
  1. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  2. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 151
  3. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agentscited by 145
  4. 2021Adversarial purification with Score-based generative modelscited by 134
  5. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
  6. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  7. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agentscited by 125
  8. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 123
  9. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  10. 2024Attacking Large Language Models with Projected Gradient Descentcited by 94
  11. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  12. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  13. 2023Robust Classification via a Single Diffusion Modelcited by 79
  14. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  15. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  16. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 74
  17. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74
  18. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Roboticscited by 73
  19. 2022Evaluating the Susceptibility of Pre-Trained Language Models via Handcrafted Adversarial Examplescited by 69
  20. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  21. 2024Building Guardrails for Large Language Modelscited by 65
  22. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  23. 2021Do Input Gradients Highlight Discriminative Features?cited by 52
  24. 2022Certified Training: Small Boxes are All You Needcited by 52
  25. 2024On Evaluating the Durability of Safeguards for Open-Weight LLMscited by 52
  26. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  27. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  28. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  29. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  30. 2023Adversarial Attacks and Defenses in Large Language Models: Old and New Threatscited by 49
  31. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 48
  32. 2024One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Modelscited by 48
  33. 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreakscited by 48
  34. 2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
  35. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  36. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  37. 2021Data Poisoning Won't Save You From Facial Recognitioncited by 45
  38. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 45

50 most cited of 555 All 555 (JSON)