mlsanityData to 7 Oct 2026

Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training

arXiv 2102.04716 ↗First posted 9 Feb 2021cs.LGcited by 58

Not on the map. Why?

Abstract (arXiv)

Delusive attacks aim to substantially deteriorate the test accuracy of the learning model by slightly perturbing the features of correctly labeled training examples. By formalizing this malicious attack as finding the worst-case training data within a specific ∞-Wasserstein ball, we show that minimizing adversarial risk on the perturbed data is equivalent to optimizing an upper bound of natural risk on the original data. This implies that adversarial training can serve as a principled defense against delusive attacks. Thus, the test accuracy decreased by delusive attacks can be largely recovered by adversarial training. To further understand the internal mechanism of the defense, we disclose that adversarial training can resist the delusive perturbations by preventing the learner from overly relying on non-robust features in a natural setting. Finally, we complement our theoretical findings with a set of experiments on popular benchmark datasets, which show that the defense withstands six different practical attacks. Both theoretical and empirical results vote for adversarial training when confronted with delusive adversaries.

Key facts. Cited by 58 papers in the map (data through 7 Oct 2026). Builds on 84 of its 148 references that are in the map. First posted on arXiv 9 Feb 2021.

Builds on

84 of 148 references.

References · 84

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  10. 2018Unsupervised Representation Learning by Predicting Image Rotationscited by 1,586
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
38 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  2. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  3. 2018Robustness May Be at Odds with Accuracycited by 873
  4. 2016Universal adversarial perturbationscited by 774
  5. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  6. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  8. 2019Self-supervised Visual Feature Learning with Deep Neural Networks: A Surveycited by 656
  9. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  10. 2020Overfitting in adversarially robust deep learningcited by 504
  11. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  12. 2018Spectral Signatures in Backdoor Attackscited by 457
  13. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  14. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  15. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  16. 2020The Pitfalls of Simplicity Bias in Neural Networkscited by 349
  17. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  18. 2018Adversarially Robust Generalization Requires More Datacited by 318
  19. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  20. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  21. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  22. 2017Certified Defenses for Data Poisoning Attackscited by 288
  23. 2019Label-Consistent Backdoor Attackscited by 285
  24. 2019Adversarial Examples Improve Image Recognitioncited by 283
  25. 2020Gradient Starvation: A Learning Proclivity in Neural Networkscited by 262
  26. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  27. 2020Bag of Tricks for Adversarial Trainingcited by 199
  28. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  29. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  30. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  31. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  32. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  33. 2020To be Robust or to be Fair: Towards Fairness in Adversarial Trainingcited by 137
  34. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  35. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  36. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
  37. 2020What shapes feature representations? Exploring datasets, architectures, and trainingcited by 125
  38. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 123

50 most cited of 84 All 84 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 8; 2023: 17; 2024: 19; 2025: 5; 2026: 5.

58 papers.

Sort:

By area:

  1. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  2. 2021Trustworthy AI: A Computational Perspectivecited by 93
  3. 2022Autoregressive Perturbations for Data Poisoningcited by 45
  4. 2023MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learningcited by 42
  5. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  6. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitationcited by 37
  7. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
  8. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learningcited by 32
  9. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  10. 2023Learning the Unlearnable: Adversarial Augmentations Suppress Unlearnable Example Attackscited by 28
  11. 2023CUDA: Convolution-based Unlearnable Datasetscited by 26
  12. 2023Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noisecited by 23
38 more
  1. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  2. 2023What Can We Learn from Unlearnable Datasets?cited by 21
  3. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  4. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
  5. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  6. 2024Provably Unlearnable Data Examplescited by 18
  7. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15
  8. 2023Average of Pruning: Improving Performance and Stability of Out-of-Distribution Detectioncited by 14
  9. 2023Detection and Defense of Unlearnable Examplescited by 13
  10. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13
  11. 2021Fooling Adversarial Training with Inducing Noisecited by 12
  12. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  13. 2024Game-Theoretic Unlearnable Example Generatorcited by 12
  14. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  15. 2024Game-Theoretic Defenses for Robust Conformal Prediction Against Adversarial Attacks in Medical Imagingcited by 10
  16. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  17. 2023APBench: A Unified Benchmark for Availability Poisoning Attacks and Defensescited by 7
  18. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  19. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  20. 2024Adversarial Training: A Surveycited by 6
  21. 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyondcited by 6
  22. 2024Nonlinear Transformations Against Unlearnable Datasetscited by 5
  23. 2024Data-Dependent Stability Analysis of Adversarial Trainingcited by 4
  24. 2025How Far Are We from True Unlearnability?cited by 4
  25. 2023What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?cited by 3
  26. 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamicscited by 3
  27. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
  28. 2024Effective and Robust Adversarial Training against Data and Label Corruptionscited by 2
  29. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  30. 2025Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Trainingcited by 2
  31. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  32. 2026Why Do Unlearnable Examples Work: A Novel Perspective of Mutual Informationcited by 2
  33. 2022Towards Fair Classification against Poisoning Attackscited by 1
  34. 2023Unlearnable Examples Give a False Sense of Data Privacy: Understanding and Relearningcited by 1
  35. 2023HINT: Healthy Influential-Noise based Training to Defend against Data Poisoning Attackscited by 1
  36. 2024Beyond Full Poisoning: Effective Availability Attacks with Partial Perturbationcited by 1
  37. 2026Perturbation-Induced Linearization: Constructing Unlearnable Data with Solely Linear Classifierscited by 1
  38. 2023Exploring Model Dynamics for Accumulative Poisoning Discoverycited by 0

50 most cited of 58 All 58 (JSON)