Data to 7 Oct 2026

Adversarial Robustness on In- and Out-Distribution Improves Explainability

arXiv 2003.09461 ↗First posted 20 Mar 2020cs.LG cs.CV stat.MLcited by 73

Not on the map. Why?

Abstract (arXiv)

Neural networks have led to major improvements in image classification but suffer from being non-robust to adversarial changes, unreliable uncertainty estimates on out-distribution samples and their inscrutable black-box decisions. In this work we propose RATIO, a training procedure for Robustness via Adversarial Training on In- and Out-distribution, which leads to robust models with reliable and robust confidence estimates on the out-distribution. RATIO has similar generative properties to adversarial training so that visual counterfactuals produce class specific features. While adversarial training comes at the price of lower clean accuracy, RATIO achieves state-of-the-art l2-adversarial robustness on CIFAR10 and maintains better clean accuracy.

Key facts. Cited by 73 papers in the map (data through 7 Oct 2026). First posted on arXiv 20 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 15; 2022: 16; 2023: 11; 2024: 12; 2025: 13; 2026: 6.

73 papers.

Sort:

By area:

2022Diffusion Models for Adversarial Purificationcited by 469
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2022Toward Transparent AI: A Survey on Interpreting the Inner Structures of Deep Neural Networkscited by 126
2021Orthogonalizing Convolutional Layers with the Cayley Transformcited by 105
2022Diffusion Visual Counterfactual Explanationscited by 96
2022The Unreasonable Effectiveness of Random Pruning: Return of the Most Naive Baseline for Sparse Trainingcited by 85
2021Explainable Artificial Intelligence (XAI) on TimeSeries Data: A Surveycited by 71
2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
2021Deep Ensembling with No Overhead for either Training or Testing: The All-Round Blessings of Dynamic Sparsitycited by 44
2022Spurious Features Everywhere -- Large-Scale Detection of Harmful Spurious Features in ImageNetcited by 41
2021DISSECT: Disentangled Simultaneous Explanations via Concept Traversalscited by 37

38 more

2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
2022Sparse Visual Counterfactual Explanations in Image Spacecited by 30
2021Removing Undesirable Feature Contributions Using Out-of-Distribution Datacited by 23
2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
2022Breaking Down Out-of-Distribution Detection: Many Methods Based on OOD Training Data Estimate a Combination of the Same Core Quantitiescited by 23
2022CNN Filter DB: An Empirical Investigation of Trained Convolutional Filterscited by 20
2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
2021Provably Robust Detection of Out-of-distribution Data (almost) for freecited by 17
2024Understanding polysemanticity in neural networks through coding theorycited by 17
2022Your Out-of-Distribution Detection Method is Not Robust!cited by 16
2024Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalizationcited by 15
2021Algorithmic Bias and Data Bias: Understanding the Relation between Distributionally Robust Optimization and Data Curationcited by 13
2022Fast and Reliable Evaluation of Adversarial Robustness with Minimum-Margin Attackcited by 13
2021Unifying Model Explainability and Robustness for Joint Text Classification and Rationale Extractioncited by 11
2023DiG-IN: Diffusion Guidance for Investigating Networks -- Uncovering Classifier Differences Neuron Visualisations and Visual Counterfactual Explanationscited by 11
2021DI-AA: An Interpretable White-box Attack for Fooling Deep Neural Networkscited by 10
2023Outlier Robust Adversarial Trainingcited by 10
2025Adversarially Robust CLIP Models Can Induce Better (Robust) Perceptual Metricscited by 10
2022How many perturbations break this model? Evaluating robustness beyond adversarial accuracycited by 9
2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 7
2022Reliable Robustness Evaluation via Automatically Constructed Attack Ensemblescited by 6
2024Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Surveycited by 6
2025Superposition as Lossy Compression: Measure with Sparse Autoencoders and Connect to Adversarial Vulnerabilitycited by 6
2021Bridging the Gap Between Adversarial Robustness and Optimization Biascited by 5
2024Feature Accentuation: Revealing 'What' Features Respond to in Natural Imagescited by 5
2024Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Informationcited by 5
2022On Attacking Out-Domain Uncertainty Estimation in Deep Neural Networkscited by 4
2023Investigating the Adversarial Robustness of Density Estimation Using the Probability Flow ODEcited by 4
2023OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shiftcited by 4
2024CoLa-DCE -- Concept-guided Latent Diffusion Counterfactual Explanationscited by 4
2024Low-Rank Adversarial PGD Attackcited by 4
2025DiSa: Directional Saliency-Aware Prompt Learning for Generalizable Vision-Language Modelscited by 4
2024Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolumecited by 3
2025Scanning Trojaned Models Using Out-of-Distribution Samplescited by 3

50 most cited of 73 All 73 (JSON)