mlsanityData to 7 Oct 2026

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

arXiv 2003.01690 ↗First posted 3 Mar 2020cs.LG cs.CV stat.MLcited by 1,442

Not on the map. Why?

Cited by 67 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The field of defense strategies against adversarial attacks has significantly grown over the last years, but progress is hampered as the evaluation of adversarial defenses is often insufficient and thus gives a wrong impression of robustness. Many promising defenses could be broken later on, making it difficult to identify the state-of-the-art. Frequent pitfalls in the evaluation are improper tuning of hyperparameters of the attacks, gradient obfuscation or masking. In this paper we first propose two extensions of the PGD-attack overcoming failures due to suboptimal step size and problems of the objective function. We then combine our novel attacks with two complementary existing ones to form a parameter-free, computationally affordable and user-independent ensemble of attacks to test adversarial robustness. We apply our ensemble to over 50 models from papers published at recent top machine learning and computer vision venues. In all except one of the cases we achieve lower robust test accuracy than reported in these papers, often by more than 10%, identifying several broken defenses.

Key facts. Cited by 1,442 papers in the map (data through 7 Oct 2026). First posted on arXiv 3 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 196; 2022: 264; 2023: 313; 2024: 276; 2025: 234; 2026: 159.

1,442 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2022Diffusion Models for Adversarial Purificationcited by 469
  3. 2021Improving Robustness using Generated Datacited by 233
  4. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  5. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  6. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 204
  7. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  8. 2021Data Augmentation Can Improve Robustnesscited by 193
  9. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  10. 2021Are Transformers More Robust Than CNNs?cited by 187
  11. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  12. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
38 more
  1. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  2. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agentscited by 129
  3. 2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Modelscited by 119
  4. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
  5. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
  6. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  7. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  8. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  9. 2021Orthogonalizing Convolutional Layers with the Cayley Transformcited by 105
  10. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  11. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  12. 2021Trustworthy AI: A Computational Perspectivecited by 93
  13. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  14. 2023A Modern Look at the Relationship between Sharpness and Generalizationcited by 91
  15. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  16. 2022On Adversarial Robustness of Trajectory Prediction for Autonomous Vehiclescited by 89
  17. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 89
  18. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  19. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  20. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  21. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  22. 2023Robust Classification via a Single Diffusion Modelcited by 79
  23. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  24. 2022Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptionscited by 78
  25. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  26. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  27. 2021When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?cited by 76
  28. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
  29. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 75
  30. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
  31. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
  32. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  33. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  34. 2021Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domaincited by 70
  35. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  36. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  37. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  38. 2022A Light Recipe to Train Robust Vision Transformerscited by 64

50 most cited of 1,442 All 1,442 (JSON)