# On Adversarial Robustness: A Neural Architecture Search perspective

arXiv: https://arxiv.org/abs/2007.08428 · HTML: https://mlsanity.com/paper/2007.08428/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Jul 2020.

## Built on by (most cited first, 22 of 22)

- [Neural Architecture Design and Robustness: A Dataset](https://mlsanity.com/paper/2306.06712/) (2023)
- [Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks](https://mlsanity.com/paper/2101.06507/) (2021)
- [A.I. Robustness: a Human-Centered Perspective on Technological Challenges and Opportunities](https://mlsanity.com/paper/2210.08906/) (2022)
- [On the Security Risks of AutoML](https://mlsanity.com/paper/2110.06018/) (2021)
- [RobArch: Designing Robust Architectures against Adversarial Attacks](https://mlsanity.com/paper/2301.03110/) (2023)
- [Generalizable Lightweight Proxy for Robust NAS against Diverse Perturbations](https://mlsanity.com/paper/2306.05031/) (2023)
- [On the Privacy Risks of Cell-Based NAS Architectures](https://mlsanity.com/paper/2209.01688/) (2022)
- [FlatNAS: optimizing Flatness in Neural Architecture Search for Out-of-Distribution Robustness](https://mlsanity.com/paper/2402.19102/) (2024)
- [Bi-fidelity Evolutionary Multiobjective Search for Adversarially Robust Deep Neural Architectures](https://mlsanity.com/paper/2207.05321/) (2022)
- [Towards Accurate and Robust Architectures via Neural Architecture Search](https://mlsanity.com/paper/2405.05502/) (2024)
- [Differentiable Search of Accurate and Robust Architectures](https://mlsanity.com/paper/2212.14049/) (2022)
- [RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation](https://mlsanity.com/paper/2301.08092/) (2023)
- [Federated Hybrid Training and Self-Adversarial Distillation: Towards Robust Edge Networks](https://mlsanity.com/paper/2412.19354/) (2024)
- [Evolving Architectures with Gradient Misalignment toward Low Adversarial Transferability](https://mlsanity.com/paper/2109.05919/) (2021)
- [Sparse and Transferable Universal Singular Vectors Attack](https://mlsanity.com/paper/2401.14031/) (2024)
- [Exploring Layerwise Adversarial Robustness Through the Lens of t-SNE](https://mlsanity.com/paper/2406.14073/) (2024)
- [Interpreting Global Perturbation Robustness of Image Models using Axiomatic Spectral Importance Decomposition](https://mlsanity.com/paper/2408.01139/) (2024)
- [Adversarial Robustness Assessment of NeuroEvolution Approaches](https://mlsanity.com/paper/2207.05451/) (2022)
- [Neural Architectural Backdoors](https://mlsanity.com/paper/2210.12179/) (2022)
- [Reinforced Compressive Neural Architecture Search for Versatile Adversarial Robustness](https://mlsanity.com/paper/2406.06792/) (2024)
- [NERO-Net: A Neuroevolutionary Approach for the Design of Adversarially Robust CNNs](https://mlsanity.com/paper/2603.25517/) (2026)
- [HERCULES: Hardware-Efficient, Robust, Continual Learning Neural Architecture Search](https://mlsanity.com/paper/2605.04103/) (2026)

## Abstract (arXiv)

Adversarial robustness of deep learning models has gained much traction in the last few years. Various attacks and defenses are proposed to improve the adversarial robustness of modern-day deep learning architectures. While all these approaches help improve the robustness, one promising direction for improving adversarial robustness is unexplored, i.e., the complex topology of the neural network architecture. In this work, we address the following question: Can the complex topology of a neural network give adversarial robustness without any form of adversarial training?. We answer this empirically by experimenting with different hand-crafted and NAS-based architectures. Our findings show that, for small-scale attacks, NAS-based architectures are more robust for small-scale datasets and simple tasks than hand-crafted architectures. However, as the size of the dataset or the complexity of task increases, hand-crafted architectures are more robust than NAS-based architectures. Our work is the first large-scale study to understand adversarial robustness purely from an architectural perspective. Our study shows that random sampling in the search space of DARTS (a popular NAS method) with simple ensembling can improve the robustness to PGD attack by nearly~12%. We show that NAS, which is popular for achieving SoTA accuracy, can provide adversarial accuracy as a free add-on without any form of adversarial training. Our results show that leveraging the search space of NAS methods with methods like ensembles can be an excellent way to achieve adversarial robustness without any form of adversarial training. We also introduce a metric that can be used to calculate the trade-off between clean accuracy and adversarial robustness. Code and pre-trained models will be made available at urlhttps://github.com/tdchaitanya/nas-robustness