# Adversarial Feature Desensitization

arXiv: https://arxiv.org/abs/2006.04621 · HTML: https://mlsanity.com/paper/2006.04621/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Jun 2020.

## Built on by (most cited first, 12 of 12)

- [Dynamical systems' based neural networks](https://mlsanity.com/paper/2210.02373/) (2022)
- [DD-RobustBench: An Adversarial Robustness Benchmark for Dataset Distillation](https://mlsanity.com/paper/2403.13322/) (2024)
- [Push Stricter to Decide Better: A Class-Conditional Feature Adaptive Framework for Improving Adversarial Robustness](https://mlsanity.com/paper/2112.00323/) (2021)
- [Towards Out-of-Distribution Adversarial Robustness](https://mlsanity.com/paper/2210.03150/) (2022)
- [Domain Conditional Predictors for Domain Adaptation](https://mlsanity.com/paper/2106.13899/) (2021)
- [Exploring Robust Features for Improving Adversarial Robustness](https://mlsanity.com/paper/2309.04650/) (2023)
- [Learning Robust Kernel Ensembles with Kernel Average Pooling](https://mlsanity.com/paper/2210.00062/) (2022)
- [Topology-preserving Adversarial Training for Alleviating Natural Accuracy Degradation](https://mlsanity.com/paper/2311.17607/) (2023)
- [Clarifying Myths About the Relationship Between Shape Bias, Accuracy, and Robustness](https://mlsanity.com/paper/2406.05006/) (2024)
- [A Guide to Robust Generalization: The Impact of Architecture, Pre-training, and Optimization Strategy](https://mlsanity.com/paper/2508.14079/) (2025)
- [Robustness to distribution shifts of compressed networks for edge devices](https://mlsanity.com/paper/2401.12014/) (2024)
- [Overlap-Aware Feature Learning for Robust Unsupervised Domain Adaptation for 3D Semantic Segmentation](https://mlsanity.com/paper/2504.01668/) (2025)

## Abstract (arXiv)

Neural networks are known to be vulnerable to adversarial attacks -- slight but carefully constructed perturbations of the inputs which can drastically impair the network's performance. Many defense methods have been proposed for improving robustness of deep networks by training them on adversarially perturbed inputs. However, these models often remain vulnerable to new types of attacks not seen during training, and even to slightly stronger versions of previously seen attacks. In this work, we propose a novel approach to adversarial robustness, which builds upon the insights from the domain adaptation field. Our method, called Adversarial Feature Desensitization (AFD), aims at learning features that are invariant towards adversarial perturbations of the inputs. This is achieved through a game where we learn features that are both predictive and robust (insensitive to adversarial attacks), i.e. cannot be used to discriminate between natural and adversarial data. Empirical results on several benchmarks demonstrate the effectiveness of the proposed approach against a wide range of attack types and attack strengths. Our code is available at https://github.com/BashivanLab/afd.