mlsanityData to 7 Oct 2026

Rethinking Natural Adversarial Examples for Classification Models

arXiv 2102.11731 ↗First posted 23 Feb 2021cs.CVcited by 9

Not on the map. Why?

Abstract (arXiv)

Recently, it was found that many real-world examples without intentional modifications can fool machine learning models, and such examples are called "natural adversarial examples". ImageNet-A is a famous dataset of natural adversarial examples. By analyzing this dataset, we hypothesized that large, cluttered and/or unusual background is an important reason why the images in this dataset are difficult to be classified. We validated the hypothesis by reducing the background influence in ImageNet-A examples with object detection techniques. Experiments showed that the object detection models with various classification models as backbones obtained much higher accuracy than their corresponding classification models. A detection model based on the classification model EfficientNet-B7 achieved a top-1 accuracy of 53.95%, surpassing previous state-of-the-art classification models trained on ImageNet, suggesting that accurate localization information can significantly boost the performance of classification models on ImageNet-A. We then manually cropped the objects in images from ImageNet-A and created a new dataset, named ImageNet-A-Plus. A human test on the new dataset showed that the deep learning-based classifiers still performed quite poorly compared with humans. Therefore, the new dataset can be used to study the robustness of classification models to the internal variance of objects without considering the background disturbance.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Builds on 39 of its 50 references that are in the map. First posted on arXiv 23 Feb 2021.

Builds on

39 of 50 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Mask R-CNNcited by 7,259
  7. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  8. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2016Feature Pyramid Networks for Object Detectioncited by 5,021
  12. 2017Squeeze-and-Excitation Networkscited by 4,763
27 more
  1. 2017Axiomatic Attribution for Deep Networkscited by 3,350
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  4. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  5. 2018YOLOv3: An Incremental Improvementcited by 2,652
  6. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  7. 2019Natural Adversarial Examplescited by 1,401
  8. 2019MMDetection: Open MMLab Detection Toolbox and Benchmarkcited by 1,379
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  10. 2019Self-training with Noisy Student improves ImageNet classificationcited by 1,304
  11. 2017Cascade R-CNN: Delving into High Quality Object Detectioncited by 1,275
  12. 2019EfficientDet: Scalable and Efficient Object Detectioncited by 1,018
  13. 2014Striving for Simplicity: The All Convolutional Netcited by 983
  14. 2016Adversarial Machine Learning at Scalecited by 934
  15. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  16. 2018Exploring the Limits of Weakly Supervised Pretrainingcited by 604
  17. 2018Certified Defenses against Adversarial Examplescited by 305
  18. 2019SOLO: Segmenting Objects by Locationscited by 289
  19. 2019Adversarial Examples Improve Image Recognitioncited by 283
  20. 2018Generalisation in humans and deep neural networkscited by 237
  21. 2019PolarMask: Single Shot Instance Segmentation with Polar Representationcited by 188
  22. 2017A Study and Comparison of Human and Deep Learning Recognition Performance Under Visual Distortionscited by 107
  23. 2020On Robustness and Transferability of Convolutional Neural Networkscited by 98
  24. 2020Adversarial Distributional Training for Robust Deep Learningcited by 79
  25. 2020On Feature Normalization and Data Augmentationcited by 71
  26. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  27. 2019Towards Robust Image Classification Using Sequential Attention Modelscited by 27

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 3; 2024: 1; 2025: 0; 2026: 3.

9 papers.

  1. 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
  2. 2023ImageNet-Hard: The Hardest Images Remaining from a Study of the Power of Zoom and Spatial Biases in Image Classificationcited by 33
  3. 2023Language-Driven Anchors for Zero-Shot Adversarial Robustnesscited by 23
  4. 2023A Survey on the Robustness of Computer Vision Models against Common Corruptionscited by 20
  5. 2022Recognizing Object by Components with Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networkscited by 18
  6. 2024PartImageNet++ Dataset: Scaling up Part-based Models for Robust Recognitioncited by 7
  7. 2026PartImageNet++ Dataset: Enhancing Visual Models with High-Quality Part Annotationscited by 0
  8. 2026Complementary Text-Guided Attention for Zero-Shot Adversarial Robustnesscited by 0
  9. 2026The Geometry of Robustness: Optimizing Loss Landscape Curvature and Feature Manifold Alignment for Robust Finetuning of Vision-Language Modelscited by 0