mlsanityData to 7 Oct 2026

Adversarial Attacks are Reversible with Natural Supervision

arXiv 2103.14222 ↗First posted 26 Mar 2021cs.CV cs.CR cs.LGcited by 47

Not on the map. Why?

Abstract (arXiv)

We find that images contain intrinsic structure that enables the reversal of many adversarial attacks. Attack vectors cause not only image classifiers to fail, but also collaterally disrupt incidental structure in the image. We demonstrate that modifying the attacked image to restore the natural structure will reverse many types of attacks, providing a defense. Experiments demonstrate significantly improved robustness for several state-of-the-art models across the CIFAR-10, CIFAR-100, SVHN, and ImageNet datasets. Our results show that our defense is still effective even if the attacker is aware of the defense mechanism. Since our defense is deployed during inference instead of training, it is compatible with pre-trained networks as well as most other defenses. Our results suggest deep networks are vulnerable to adversarial examples partly because their representations do not enforce the natural structure of images.

Key facts. Cited by 47 papers in the map (data through 7 Oct 2026). Builds on 53 of its 71 references that are in the map. First posted on arXiv 26 Mar 2021.

Builds on

53 of 71 references.

References · 53

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  5. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,712
  10. 2016Wide Residual Networkscited by 3,057
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  12. 2020Unsupervised Learning of Visual Features by Contrasting Cluster Assignmentscited by 2,845
38 more
  1. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  2. 2019Scalability in Perception for Autonomous Driving: Waymo Open Datasetcited by 2,436
  3. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
  4. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2018PointPillars: Fast Encoders for Object Detection from Point Cloudscited by 1,707
  7. 2018Unsupervised Representation Learning by Predicting Image Rotationscited by 1,586
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2016Context Encoders: Feature Learning by Inpaintingcited by 1,424
  11. 2016Unsupervised Learning of Visual Representations by Solving Jigsaw Puzzlescited by 1,379
  12. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  13. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  14. 2016Colorful Image Colorizationcited by 1,113
  15. 2018Robustness May Be at Odds with Accuracycited by 873
  16. 2019Self-Supervised Learning of Pretext-Invariant Representationscited by 806
  17. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  18. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  19. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  20. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  21. 2017Countering Adversarial Images using Input Transformationscited by 517
  22. 2019Using Self-Supervised Learning Can Improve Model Robustness and Uncertaintycited by 511
  23. 2020Overfitting in adversarially robust deep learningcited by 504
  24. 2019On Evaluating Adversarial Robustnesscited by 442
  25. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  26. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  27. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  28. 2020Space-Time Correspondence as a Contrastive Random Walkcited by 239
  29. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  30. 2020Bag of Tricks for Adversarial Trainingcited by 199
  31. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  32. 2020SpeedNet: Learning the Speediness in Videoscited by 171
  33. 2018Tracking Emerges by Colorizing Videoscited by 166
  34. 2019Are Labels Required for Improving Adversarial Robustness?cited by 162
  35. 2019Metric Learning for Adversarial Robustnesscited by 77
  36. 2019The Odds are Odd: A Statistical Test for Detecting Adversarial Examplescited by 75
  37. 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
  38. 2019A New Defense Against Adversarial Images: Turning a Weakness into a Strengthcited by 49

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 12; 2023: 15; 2024: 11; 2025: 6; 2026: 1.

47 papers.

Sort:

By area:

  1. 2021MEMO: Test Time Robustness via Adaptation and Augmentationcited by 376
  2. 2023A Comprehensive Survey on Test-Time Adaptation under Distribution Shiftscited by 353
  3. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
  4. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  5. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  6. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 61
  7. 2022Visual Prompting for Adversarial Robustnesscited by 33
  8. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  9. 2023Self-Interpretable Time Series Prediction with Counterfactual Explanationscited by 24
  10. 2025CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIPcited by 23
  11. 2023Convolutional Visual Prompt for Robust Visual Perceptioncited by 17
  12. 2022Landscape Learning for Neural Network Inversioncited by 15
35 more
  1. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  2. 2024GDA: Generalized Diffusion for Robust Test-time Adaptationcited by 14
  3. 2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 14
  4. 2025Enhancing CLIP Robustness via Cross-Modality Alignmentcited by 14
  5. 2022Robust Perception through Equivariancecited by 9
  6. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  7. 2022Adversarial Purification with the Manifold Hypothesiscited by 8
  8. 2021Real-Time Neural Voice Camouflagecited by 6
  9. 2023Taxonomy-Structured Domain Adaptationcited by 6
  10. 2022Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learningcited by 5
  11. 2024PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attackscited by 5
  12. 2024Meta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attackscited by 5
  13. 2022Using Multiple Self-Supervised Tasks Improves Model Robustnesscited by 4
  14. 2023Test-time Detection and Repair of Adversarial Samples via Masked Autoencodercited by 4
  15. 2023Robust Feature Inference: A Test-time Defense Strategy using Spectral Projectionscited by 3
  16. 2024Interpretability-Guided Test-Time Adversarial Defensecited by 3
  17. 2022Adversarially Robust Video Perception by Seeing Motioncited by 2
  18. 2023Improving Adversarial Robustness of DEQs with Explicit Regulations Along the Neural Dynamicscited by 2
  19. 2023Robustifying Language Models with Test-Time Adaptationcited by 2
  20. 2022Test-time adversarial detection and robustness for localizing humans using ultra wide band channel impulse responsescited by 1
  21. 2023Advancing Adversarial Training by Injecting Booster Signalcited by 1
  22. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  23. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  24. 2024Secure Video Quality Assessment Resisting Adversarial Attackscited by 1
  25. 2024SPIN: Self-Supervised Prompt INjectioncited by 1
  26. 2024Stealthy Multi-Task Adversarial Attackscited by 1
  27. 2025A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detectioncited by 1
  28. 2025Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defensecited by 1
  29. 2025ATAC: Augmentation-Based Test-Time Adversarial Correction for CLIPcited by 1
  30. 2022Federated Adversarial Training with Transformerscited by 0
  31. 2023Beckman Defensecited by 0
  32. 2023Revisiting and Advancing Adversarial Training Through A Simple Baselinecited by 0
  33. 2023Advancing Adversarial Robustness Through Adversarial Logit Updatecited by 0
  34. 2023RAEDiff: Denoising Diffusion Probabilistic Models Based Reversible Adversarial Examples Self-Generation and Self-Recoverycited by 0
  35. 2026Rectifying Adversarial Examples Using Their Vulnerabilitiescited by 0