mlsanityData to 7 Oct 2026

RobustBench: a standardized adversarial robustness benchmark

arXiv 2010.09670 ↗First posted 19 Oct 2020cs.LG cs.CR cs.CVcited by 659

Not on the map. Why?

Cited by 21 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

As a research community, we are still lacking a systematic understanding of the progress on adversarial robustness which often makes it hard to identify the most promising ideas in training robust models. A key challenge in benchmarking robustness is that its evaluation is often error-prone leading to robustness overestimation. Our goal is to establish a standardized benchmark of adversarial robustness, which as accurately as possible reflects the robustness of the considered models within a reasonable computational budget. To this end, we start by considering the image classification task and introduce restrictions (possibly loosened in the future) on the allowed models. We evaluate adversarial robustness with AutoAttack, an ensemble of white- and black-box attacks, which was recently shown in a large-scale study to improve almost all robustness evaluations compared to the original publications. To prevent overadaptation of new defenses to AutoAttack, we welcome external evaluations based on adaptive attacks, especially where AutoAttack flags a potential overestimation of robustness. Our leaderboard, hosted at https://robustbench.github.io/, contains evaluations of 120+ models and aims at reflecting the current state of the art in image classification on a set of well-defined tasks in ℓ_∞- and ℓ2-threat models and on common corruptions, with possible extensions in the future. Additionally, we open-source the library https://github.com/RobustBench/robustbench that provides unified access to 80+ robust models to facilitate their downstream applications. Finally, based on the collected models, we analyze the impact of robustness on the performance on distribution shifts, calibration, out-of-distribution detection, fairness, privacy leakage, smoothness, and transferability.

Key facts. Cited by 659 papers in the map (data through 7 Oct 2026). First posted on arXiv 19 Oct 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 61; 2022: 104; 2023: 162; 2024: 134; 2025: 120; 2026: 78.

659 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2022Continual Test-Time Domain Adaptationcited by 520
  3. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  4. 2022Diffusion Models for Adversarial Purificationcited by 469
  5. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  6. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  7. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  8. 2021Unsolved Problems in ML Safetycited by 291
  9. 2021Improving Robustness using Generated Datacited by 233
  10. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  11. 2021Trustworthy AI: From Principles to Practicescited by 206
  12. 2022Surgical Fine-Tuning Improves Adaptation to Distribution Shiftscited by 205
38 more
  1. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  2. 2021Data Augmentation Can Improve Robustnesscited by 193
  3. 2023Robust Test-Time Adaptation in Dynamic Scenarioscited by 185
  4. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  5. 2021Adversarial purification with Score-based generative modelscited by 132
  6. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agentscited by 129
  7. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  8. 2023EcoTTA: Memory-Efficient Continual Test-time Adaptation via Self-distilled Regularizationcited by 123
  9. 20223D Common Corruptions and Data Augmentationcited by 120
  10. 2021Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyondcited by 116
  11. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  12. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  13. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  14. 2022Robust Mean Teacher for Continual and Gradual Test-Time Adaptationcited by 102
  15. 2022Decorate the Newcomers: Visual Domain Prompt for Continual Test Time Adaptationcited by 98
  16. 2021Trustworthy AI: A Computational Perspectivecited by 93
  17. 2025DriveSuprim: Towards Precise Trajectory Selection for End-to-End Planningcited by 91
  18. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  19. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  20. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  21. 2023Robust Classification via a Single Diffusion Modelcited by 79
  22. 2024Prover-Verifier Games improve legibility of LLM outputscited by 79
  23. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  24. 2022Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptionscited by 78
  25. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  26. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  27. 2022Improving Test-Time Adaptation via Shift-agnostic Weight Regularization and Nearest Source Prototypescited by 67
  28. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  29. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  30. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  31. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  32. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  33. 2021A Winning Hand: Compressing Deep Networks Can Improve Out-Of-Distribution Robustnesscited by 62
  34. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  35. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  36. 2022Assaying Out-Of-Distribution Generalization in Transfer Learningcited by 53
  37. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  38. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50

50 most cited of 659 All 659 (JSON)