mlsanityData to 14 Oct 2026

Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart

arXiv 2105.14785 ↗First posted 31 May 2021cs.LG cs.CR cs.CVcited by 14

Not on the map. Why?

Abstract (arXiv)

Correctly classifying adversarial examples is an essential but challenging requirement for safely deploying machine learning models. As reported in RobustBench, even the state-of-the-art adversarially trained models struggle to exceed 67% robust test accuracy on CIFAR-10, which is far from practical. A complementary way towards robustness is to introduce a rejection option, allowing the model to not return predictions on uncertain inputs, where confidence is a commonly used certainty proxy. Along with this routine, we find that confidence and a rectified confidence (R-Con) can form two coupled rejection metrics, which could provably distinguish wrongly classified inputs from correctly classified ones. This intriguing property sheds light on using coupling strategies to better detect and reject adversarial examples. We evaluate our rectified rejection (RR) module on CIFAR-10, CIFAR-10-C, and CIFAR-100 under several attacks including adaptive ones, and demonstrate that the RR module is compatible with different adversarial training frameworks on improving robustness, with little extra computation. The code is available at https://github.com/P2333/Rectified-Rejection.

Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Builds on 94 of its 112 references that are in the map. First posted on arXiv 31 May 2021.

Builds on

94 of 112 references.

References · 94

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2017On Calibration of Modern Neural Networkscited by 4,960
  7. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,750
  8. 2016Wide Residual Networkscited by 3,070
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  10. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  11. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  12. 2016Understanding deep learning requires rethinking generalizationcited by 1,674
38 more
  1. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  2. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  5. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  6. 2020Energy-based Out-of-distribution Detectioncited by 1,299
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  8. 2017Selective Classification for Deep Neural Networkscited by 852
  9. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  10. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 776
  11. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  12. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  13. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  14. 2019Adversarial Training for Free!cited by 643
  15. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  16. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  17. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  18. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  19. 2019On Evaluating Adversarial Robustnesscited by 447
  20. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  21. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  22. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  23. 2019SelectiveNet: A Deep Neural Network with an Integrated Reject Optioncited by 350
  24. 2018Adversarially Robust Generalization Requires More Datacited by 318
  25. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
  26. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 278
  27. 2017Detecting Adversarial Samples from Artifactscited by 245
  28. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
  29. 2017On Detecting Adversarial Perturbationscited by 232
  30. 2020Understanding and Improving Fast Adversarial Trainingcited by 214
  31. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  32. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
  33. 2020Bag of Tricks for Adversarial Trainingcited by 200
  34. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  35. 2019Addressing Failure Prediction by Learning Model Confidencecited by 186
  36. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
  37. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 183
  38. 2017On the (Statistical) Detection of Adversarial Examplescited by 180

50 most cited of 94 All 94 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 6; 2024: 2; 2025: 3; 2026: 1.

14 papers.

Sort:

  1. 2021Machine Learning with a Reject Option: A surveycited by 109
  2. 2023Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Scorecited by 20
  3. 2022A.I. Robustness: a Human-Centered Perspective on Technological Challenges and Opportunitiescited by 9
  4. 2023Stratified Adversarial Robustness with Rejectioncited by 4
  5. 2023AdvFAS: A robust face anti-spoofing framework against adversarial examplescited by 3
  6. 2025One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancycited by 3
  7. 2025Pulling Back the Curtain: Unsupervised Adversarial Detection via Contrastive Auxiliary Networkscited by 2
  8. 2025Sample-Specific Noise Injection For Diffusion-Based Adversarial Purificationcited by 2
  9. 2023A Comprehensive Assessment Benchmark for Rigorously Evaluating Deep Learning Image Classifierscited by 1
  10. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  11. 2023A Minimax Approach Against Multi-Armed Adversarial Attacks Detectioncited by 0
  12. 2023Two Heads are Actually Better than One: Towards Better Adversarial Robustness via Transduction and Rejectioncited by 0
2 more
  1. 2024Optimal Zero-Shot Detector for Multi-Armed Attackscited by 0
  2. 2026Laws of Learning Dynamics and the Core of Learnerscited by 0