mlsanityData to 7 Oct 2026

Mind the box: l1-APGD for sparse adversarial attacks on image classifiers

arXiv 2103.01208 ↗First posted 1 Mar 2021cs.LG cs.CVcited by 50

Not on the map. Why?

Abstract (arXiv)

We show that when taking into account also the image domain [0,1]d, established l1-projected gradient descent (PGD) attacks are suboptimal as they do not consider that the effective threat model is the intersection of the l1-ball and [0,1]d. We study the expected sparsity of the steepest descent step for this effective threat model and show that the exact projection onto this set is computationally feasible and yields better performance. Moreover, we propose an adaptive form of PGD which is highly effective even with a small budget of iterations. Our resulting l1-APGD is a strong white-box attack showing that prior works overestimated their l1-robustness. Using l1-APGD for adversarial training we get a robust classifier with SOTA l1-robustness. Finally, we combine l1-APGD and an adaptation of the Square Attack to l1 into l1-AutoAttack, an ensemble of attacks which reliably assesses adversarial robustness for the threat model of l1-ball intersected with [0,1]d.

Key facts. Cited by 50 papers in the map (data through 7 Oct 2026). Builds on 28 of its 42 references that are in the map. First posted on arXiv 1 Mar 2021.

Builds on

28 of 42 references.

References · 28

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  8. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  9. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  10. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  11. 2020Overfitting in adversarially robust deep learningcited by 504
  12. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
16 more
  1. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  2. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  3. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  4. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  5. 2020Adversarial Self-Supervised Contrastive Learningcited by 138
  6. 2018Towards the first adversarially robust neural network model on MNISTcited by 104
  7. 2018SparseFool: a few pixels make a big differencecited by 94
  8. 2019Adversarial Robustness Against the Union of Multiple Perturbation Modelscited by 88
  9. 2020Do Wider Neural Networks Really Help Adversarial Robustness?cited by 79
  10. 2020Adversarial Robustness on In- and Out-Distribution Improves Explainabilitycited by 73
  11. 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
  12. 2019Accurate, reliable and fast robustness evaluationcited by 43
  13. 2020Augmented Lagrangian Adversarial Attackscited by 28
  14. 2019On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Methodcited by 21
  15. 2020Learning to Generate Noise for Multi-Attack Robustnesscited by 17
  16. 2020Adversarial Momentum-Contrastive Pre-Trainingcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 3; 2023: 12; 2024: 16; 2025: 6; 2026: 8.

50 papers.

Sort:

By area:

  1. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  2. 2022Sparse Visual Counterfactual Explanations in Image Spacecited by 30
  3. 2023R-LPIPS: An Adversarially Robust Perceptual Similarity Metriccited by 27
  4. 2024On the Duality Between Sharpness-Aware Minimization and Adversarial Trainingcited by 24
  5. 2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
  6. 2023Seasoning Model Soups for Robustness to Adversarial and Natural Distribution Shiftscited by 23
  7. 2022Can we achieve robustness from data alone?cited by 16
  8. 2023The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attackscited by 15
  9. 2023LipSim: A Provably Robust Perceptual Similarity Metriccited by 15
  10. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  11. 2023Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Modelscited by 12
  12. 2021On the Impact of Hard Adversarial Instances on Overfitting in Adversarial Trainingcited by 11
38 more
  1. 2021Protein Folding Neural Networks Are Not Robustcited by 7
  2. 2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
  3. 2023MultiRobustBench: Benchmarking Robustness Against Multiple Attackscited by 7
  4. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
  5. 2024BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attackcited by 7
  6. 2023Optimization and Optimizers for Adversarial Robustnesscited by 6
  7. 2024FAIR-TAT: Improving Model Fairness Using Targeted Adversarial Trainingcited by 5
  8. 2026Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networkscited by 5
  9. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  10. 2024The Uncanny Valley: Exploring Adversarial Robustness from a Flatness Perspectivecited by 4
  11. 2024A Unified Understanding of Adversarial Vulnerability Regarding Unimodal Models and Vision-Language Pre-training Modelscited by 4
  12. 2023Where and How to Attack? A Causality-Inspired Recipe for Generating Counterfactual Adversarial Examplescited by 3
  13. 2024Towards Class-wise Robustness Analysiscited by 3
  14. 2025When Flatness Does (Not) Guarantee Adversarial Robustnesscited by 3
  15. 2022Multiple Perturbation Attack: Attack Pixelwise Under Different ℓp-norms For Better Adversarial Performancecited by 2
  16. 2023Towards Better Certified Segmentation via Diffusion Modelscited by 2
  17. 2024Boosting Few-Pixel Robustness Verification via Covering Verification Designscited by 2
  18. 2025Boosting the Local Invariance for Better Adversarial Transferabilitycited by 2
  19. 2025MAIA: An Inpainting-Based Approach for Music Adversarial Attackscited by 2
  20. 2025Angular Gradient Sign Method: Uncovering Vulnerabilities in Hyperbolic Networkscited by 2
  21. 2021Internal Wasserstein Distance for Adversarial Attack and Defensecited by 1
  22. 2024Stealthy Multi-Task Adversarial Attackscited by 1
  23. 2023Fix your downsampling ASAP! Be natively more robust via Aliasing and Spectral Artifact free Poolingcited by 0
  24. 2023On Continuity of Robust and Accurate Classifierscited by 0
  25. 2024On Robustness and Generalization of ML-Based Congestion Predictors to Valid and Imperceptible Perturbationscited by 0
  26. 2024Patch Synthesis for Property Repair of Deep Neural Networkscited by 0
  27. 2024Transform-Dependent Adversarial Attackscited by 0
  28. 2024Unrevealed Threats: A Comprehensive Study of the Adversarial Robustness of Underwater Image Enhancement Modelscited by 0
  29. 2024Sparse patches adversarial attacks via extrapolating point-wise informationcited by 0
  30. 2025Fast Adversarial Training against Sparse Attacks Requires Loss Smoothingcited by 0
  31. 2025Structured Universal Adversarial Attacks on Object Detection for Video Sequencescited by 0
  32. 2026Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attackscited by 0
  33. 2026Analyzing Physical Adversarial Example Threats to Machine Learning in Election Systemscited by 0
  34. 2026Memory Efficient Full-gradient Attacks (MEFA) Framework for Adversarial Defense Evaluationscited by 0
  35. 2026Localize and Neutralize: Gradient-guided Token Suppression against Visual Prompt Injection Attackcited by 0
  36. 2026OVIG: Optimistic Verification of AI Training Integrity via Gradient Signalscited by 0
  37. 2026Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluationcited by 0
  38. 2026Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraintscited by 0