mlsanityData to 7 Oct 2026

Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks

arXiv 2105.08714 ↗First posted 18 May 2021cs.LG cs.CR cs.CVcited by 19

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks optimize against models to defeat defenses. Existing defenses are static, and stay the same once trained, even while attacks change. We argue that models should fight back, and optimize their defenses against attacks at test time. We propose dynamic defenses, to adapt the model and input during testing, by defensive entropy minimization (dent). Dent alters testing, but not training, for compatibility with existing models and train-time defenses. Dent improves the robustness of adversarially-trained defenses and nominally-trained models against white-box, black-box, and adaptive attacks on CIFAR-10/100 and ImageNet. In particular, dent boosts state-of-the-art defenses by 20+ points absolute against AutoAttack on CIFAR-10 at ε_∞ = 8/255.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 59 of its 70 references that are in the map. First posted on arXiv 18 May 2021.

Builds on

59 of 70 references.

References · 59

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2018Neural Ordinary Differential Equationscited by 3,733
  10. 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,413
  11. 2016Wide Residual Networkscited by 3,057
  12. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
38 more
  1. 2017FiLM: Visual Reasoning with a General Conditioning Layercited by 2,286
  2. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  6. 2017CyCADA: Cycle-Consistent Adversarial Domain Adaptationcited by 1,079
  7. 2020Designing Network Design Spacescited by 954
  8. 2020Do We Really Need to Access the Source Data? Source Hypothesis Transfer for Unsupervised Domain Adaptationcited by 844
  9. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  11. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  12. 2019Deep Equilibrium Modelscited by 603
  13. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  14. 2017Countering Adversarial Images using Input Transformationscited by 517
  15. 2020Overfitting in adversarially robust deep learningcited by 504
  16. 2016Adaptive Computation Time for Recurrent Neural Networkscited by 479
  17. 2020Improving robustness against common corruptions by covariate shift adaptationcited by 427
  18. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  19. 2015Neural Module Networkscited by 375
  20. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  21. 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 350
  22. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  23. 2017SkipNet: Learning Dynamic Routing in Convolutional Networkscited by 328
  24. 2019CondConv: Conditionally Parameterized Convolutions for Efficient Inferencecited by 273
  25. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  26. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  27. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  28. 2020Source Data-absent Unsupervised Domain Adaptation through Hypothesis Transfer and Labeling Transfercited by 173
  29. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  30. 2018Disentangling Adversarial Robustness and Generalizationcited by 171
  31. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  32. 2017Convolutional Networks with Adaptive Inference Graphscited by 147
  33. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  34. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  35. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  36. 2017TensorFlow-Serving: Flexible, High-Performance ML Servingcited by 85
  37. 2019Open Compound Domain Adaptationcited by 76
  38. 2019On Network Design Spaces for Visual Recognitioncited by 68

50 most cited of 59 All 59 (JSON)

Built on by

Cited by year

Citing papers per year: 2021: 2; 2022: 6; 2023: 7; 2024: 1; 2025: 3.

19 papers.

Sort:

  1. 2023A Comprehensive Survey on Test-Time Adaptation under Distribution Shiftscited by 353
  2. 2021Unsolved Problems in ML Safetycited by 291
  3. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  4. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  5. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
  6. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  7. 2023Uncovering Adversarial Risks of Test-Time Adaptationcited by 12
  8. 2021Towards Evaluating the Robustness of Neural Networks Learned by Transductioncited by 8
  9. 2022Adversarial Purification with the Manifold Hypothesiscited by 8
  10. 2023Revisiting the Trade-off between Accuracy and Robustness via Weight Distribution of Filterscited by 4
  11. 2023Robust Feature Inference: A Test-time Defense Strategy using Spectral Projectionscited by 3
  12. 2023Dynamic ensemble selection based on Deep Neural Network Uncertainty Estimation for Adversarial Robustnesscited by 2
7 more
  1. 2025Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensemblescited by 2
  2. 2022Unifying Gradients to Improve Real-world Robustness for Deep Networkscited by 1
  3. 2022Test-time adversarial detection and robustness for localizing humans using ultra wide band channel impulse responsescited by 1
  4. 2024Improving Adversarial Robustness via Feature Pattern Consistency Constraintcited by 1
  5. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  6. 2025Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defensecited by 1
  7. 2023Two Heads are Actually Better than One: Towards Better Adversarial Robustness via Transduction and Rejectioncited by 0