mlsanityData to 7 Oct 2026

Adversarial Example Detection for DNN Models: A Review and Experimental Comparison

arXiv 2105.00203 ↗First posted 1 May 2021cs.CV cs.CRcited by 51

Not on the map. Why?

Abstract (arXiv)

Deep learning (DL) has shown great success in many human-related tasks, which has led to its adoption in many computer vision based applications, such as security surveillance systems, autonomous vehicles and healthcare. Such safety-critical applications have to draw their path to success deployment once they have the capability to overcome safety-critical challenges. Among these challenges are the defense against or/and the detection of the adversarial examples (AEs). Adversaries can carefully craft small, often imperceptible, noise called perturbations to be added to the clean image to generate the AE. The aim of AE is to fool the DL model which makes it a potential risk for DL applications. Many test-time evasion attacks and countermeasures,i.e., defense or detection methods, are proposed in the literature. Moreover, few reviews and surveys were published and theoretically showed the taxonomy of the threats and the countermeasure methods with little focus in AE detection methods. In this paper, we focus on image classification task and attempt to provide a survey for detection methods of test-time evasion attacks on neural network classifiers. A detailed discussion for such methods is provided with experimental results for eight state-of-the-art detectors under different scenarios on four datasets. We also provide potential challenges and future perspectives for this research direction.

Key facts. Cited by 51 papers in the map (data through 7 Oct 2026). Builds on 108 of its 150 references that are in the map. First posted on arXiv 1 May 2021.

Builds on

108 of 150 references.

References · 108

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  11. 2013Intriguing properties of neural networkscited by 5,114
  12. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
38 more
  1. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  2. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,530
  3. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2015Fast R-CNNcited by 2,930
  6. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,801
  7. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,772
  8. 2016A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networkscited by 2,362
  9. 2013Rich feature hierarchies for accurate object detection and semantic segmentationcited by 2,160
  10. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  11. 2016Adversarial examples in the physical worldcited by 1,762
  12. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,472
  13. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  14. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  15. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  16. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  17. 2014Striving for Simplicity: The All Convolutional Netcited by 983
  18. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  19. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  20. 2016Conditional Image Generation with PixelCNN Decoderscited by 859
  21. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  22. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  23. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
  24. 2016Universal adversarial perturbationscited by 774
  25. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  26. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  27. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  28. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  29. 2017One pixel attack for fooling deep neural networkscited by 579
  30. 2016Fully-Convolutional Siamese Networks for Object Trackingcited by 566
  31. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  32. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  33. 2015An Introduction to Convolutional Neural Networkscited by 510
  34. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  35. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  36. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  37. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  38. 2020Backdoor Learning: A Surveycited by 412

50 most cited of 108 All 108 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 13; 2023: 15; 2024: 9; 2025: 8; 2026: 2.

51 papers.

Sort:

By area:

  1. 2022FedPrompt: Communication-Efficient and Privacy Preserving Prompt Tuning in Federated Learningcited by 86
  2. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  3. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  4. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  5. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
  6. 2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
  7. 2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 16
  8. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  9. 2023Adversarial Resilience in Sequential Prediction via Abstentioncited by 11
  10. 2021DI-AA: An Interpretable White-box Attack for Fooling Deep Neural Networkscited by 10
  11. 2021RAILS: A Robust Adversarial Immune-inspired Learning Systemcited by 8
  12. 2022Confident AIcited by 6
38 more
  1. 2024Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Surveycited by 6
  2. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  3. 2022Class-Level Logit Perturbationcited by 4
  4. 2022Adversarial Artifact Detection in EEG-Based Brain-Computer Interfacescited by 4
  5. 2023Unsupervised Adversarial Detection without Extra Model: Training Loss Should Changecited by 4
  6. 2022Nowhere to Hide: A Lightweight Unsupervised Detector against Adversarial Examplescited by 3
  7. 2023Toward Stronger Textual Attack Detectorscited by 3
  8. 2024Privacy-preserving Universal Adversarial Defense for Black-box Modelscited by 3
  9. 2025Debugging and Runtime Analysis of Neural Networks with VLMs (A Case Study)cited by 3
  10. 2022On Trace of PGD-Like Adversarial Attackscited by 2
  11. 2022Detecting Adversarial Examples in Batches -- a geometrical approachcited by 2
  12. 2022MEAD: A Multi-Armed Approach for Evaluation of Adversarial Examples Detectorscited by 2
  13. 2022Employing Deep Ensemble Learning for Improving the Security of Computer Networks against Adversarial Attackscited by 2
  14. 2023Exploring the Connection between Robust and Generative Modelscited by 2
  15. 2024Adversarial Attacks and Defenses in Fault Detection and Diagnosis: A Comprehensive Benchmark on the Tennessee Eastman Processcited by 2
  16. 2025When and Where do Data Poisons Attack Textual Inversion?cited by 2
  17. 2021GGT: Graph-Guided Testing for Adversarial Sample Detection of Deep Neural Networkcited by 1
  18. 2023Adversarial Examples Detection with Enhanced Image Difference Features based on Local Histogram Equalizationcited by 1
  19. 2023Towards Black-box Adversarial Example Detection: A Data Reconstruction-based Methodcited by 1
  20. 2023Adversarial Sample Detection Through Neural Network Transport Dynamicscited by 1
  21. 2023X-Detect: Explainable Adversarial Patch Detection for Object Detectors in Retailcited by 1
  22. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  23. 2024Diffusion-based Adversarial Purification for Intrusion Detectioncited by 1
  24. 2022Federated Adversarial Training with Transformerscited by 0
  25. 2022Adversarial Detection by Approximation of Ensemble Boundarycited by 0
  26. 2023Threats, Vulnerabilities, and Controls of Machine Learning Based Systems: A Survey and Taxonomycited by 0
  27. 2023A Minimax Approach Against Multi-Armed Adversarial Attacks Detectioncited by 0
  28. 2023Scaling Model Checking for DNN Analysis via State-Space Reduction and Input Segmentation (Extended Version)cited by 0
  29. 2023On Continuity of Robust and Accurate Classifierscited by 0
  30. 2023QuadAttack: A Quadratic Programming Approach to Ordered Top-K Attackscited by 0
  31. 2024Topological safeguard for evasion attack interpreting the neural networks' behaviorcited by 0
  32. 2024Optimal Zero-Shot Detector for Multi-Armed Attackscited by 0
  33. 2024R.I.P.: A Simple Black-box Attack on Continual Test-time Adaptationcited by 0
  34. 2025SimPRIVE: a Simulation framework for Physical Robot Interaction with Virtual Environmentscited by 0
  35. 2025How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real Worldcited by 0
  36. 2025KoALA: KL-L0 Adversarial Detector via Label Agreementcited by 0
  37. 2025Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areascited by 0
  38. 2026Contract And Conquer: How to Provably Compute Adversarial Examples for a Black-Box Model?cited by 0

50 most cited of 51 All 51 (JSON)