mlsanityData to 13 Oct 2026

Attacking Adversarial Attacks as A Defense

arXiv 2106.04938 ↗First posted 9 Jun 2021cs.LG cs.CRcited by 31

Not on the map. Why?

Abstract (arXiv)

It is well known that adversarial attacks can fool deep neural networks with imperceptible perturbations. Although adversarial training significantly improves model robustness, failure cases of defense still broadly exist. In this work, we find that the adversarial attacks can also be vulnerable to small perturbations. Namely, on adversarially-trained models, perturbing adversarial examples with a small random noise may invalidate their misled predictions. After carefully examining state-of-the-art attacks of various kinds, we find that all these attacks have this deficiency to different extents. Enlightened by this finding, we propose to counter attacks by crafting more effective defensive perturbations. Our defensive perturbations leverage the advantage that adversarial training endows the ground-truth class with smaller local Lipschitzness. By simultaneously attacking all the classes, the misled predictions with larger Lipschitzness can be flipped into correct ones. We verify our defensive perturbation with both empirical experiments and theoretical analyses on a linear model. On CIFAR10, it boosts the state-of-the-art model from 66.16% to 72.66% against the four attacks of AutoAttack, including 71.76% to 83.30% against the Square attack. On ImageNet, the top-1 robust accuracy of FastAT is improved from 33.18% to 38.54% under the 100-step PGD attack.

Key facts. Cited by 31 papers in the map (data through 13 Oct 2026). Builds on 50 of its 69 references that are in the map. First posted on arXiv 9 Jun 2021.

Builds on

50 of 69 references.

References · 50

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,336
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
  3. 2013Intriguing properties of neural networkscited by 5,137
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,992
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,511
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,445
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,336
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,316
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,265
  10. 2017Visualizing the Loss Landscape of Neural Netscited by 1,129
  11. 2018Deep Anomaly Detection with Outlier Exposurecited by 941
  12. 2018Robustness May Be at Odds with Accuracycited by 878
38 more
  1. 2017Ensemble Adversarial Training: Attacks and Defensescited by 839
  2. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  3. 2020Fast is better than free: Revisiting adversarial trainingcited by 725
  4. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 684
  5. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 676
  6. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 663
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 658
  8. 2017Countering Adversarial Images using Input Transformationscited by 519
  9. 2020Overfitting in adversarially robust deep learningcited by 505
  10. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 467
  11. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  12. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  13. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  14. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  15. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 291
  16. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 277
  17. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  18. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  19. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  20. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  21. 2018Disentangling Adversarial Robustness and Generalizationcited by 172
  22. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  23. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  24. 2017The Space of Transferable Adversarial Examplescited by 157
  25. 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 153
  26. 2019Adversarial Robustness through Local Linearizationcited by 146
  27. 2020Self-Adaptive Training: beyond Empirical Risk Minimizationcited by 126
  28. 2020Boosting Adversarial Training with Hypersphere Embeddingcited by 97
  29. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
  30. 2020Learnable Boundary Guided Adversarial Trainingcited by 93
  31. 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
  32. 2019An Alternative Surrogate Loss for PGD-based Adversarial Testingcited by 45
  33. 2019Jacobian Adversarially Regularized Networks for Robustnesscited by 40
  34. 2020Randomization matters. How to defend against strong adversarial attackscited by 37
  35. 2020Efficient Robust Training via Backward Smoothingcited by 29
  36. 2020A Game Theoretic Analysis of Additive Adversarial Attacks and Defensescited by 21
  37. 2019Saliency Methods for Explaining Adversarial Attackscited by 16
  38. 2020HYDRA: Pruning Adversarially Robust Neural Networkscited by 10

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2021: 1; 2022: 8; 2023: 9; 2024: 4; 2025: 5; 2026: 4.

31 papers.

Sort:

By area:

  1. 2023A Comprehensive Survey on Test-Time Adaptation under Distribution Shiftscited by 355
  2. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  3. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  4. 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
  5. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  6. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 35
  7. 2022Robust Weight Perturbation for Adversarial Trainingcited by 25
  8. 2025CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIPcited by 23
  9. 2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 15
  10. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  11. 2025Enhancing CLIP Robustness via Cross-Modality Alignmentcited by 14
  12. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
19 more
  1. 2023Class-Conditioned Transformation for Enhanced Robust Image Classificationcited by 5
  2. 2023Robust Feature Inference: A Test-time Defense Strategy using Spectral Projectionscited by 3
  3. 2024Interpretability-Guided Test-Time Adversarial Defensecited by 3
  4. 2025Self-Calibrated Consistency can Fight Back for Adversarial Robustness in Vision-Language Modelscited by 3
  5. 2022Adversarially Robust Video Perception by Seeing Motioncited by 2
  6. 2023Improving Adversarial Robustness of DEQs with Explicit Regulations Along the Neural Dynamicscited by 2
  7. 2025PRISM: Robust VLM Alignment with Principled Reasoning for Integrated Safety in Multimodalitycited by 2
  8. 2026Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIPcited by 2
  9. 2022Learning Robust Kernel Ensembles with Kernel Average Poolingcited by 1
  10. 2022Test-time adversarial detection and robustness for localizing humans using ultra wide band channel impulse responsescited by 1
  11. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  12. 2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1
  13. 2026When CLIP Sees More, It Fights Back Harder: Multi-View Guided Adaptive Counterattacks for Test-Time Adversarial Robustnesscited by 1
  14. 2023Explainability and Robustness of Deep Visual Classification Modelscited by 0
  15. 2023Beckman Defensecited by 0
  16. 2023Adaptive Attractors: A Defense Strategy against ML Adversarial Collusion Attackscited by 0
  17. 2023Advancing Adversarial Robustness Through Adversarial Logit Updatecited by 0
  18. 2024Counter-Samples: A Stateless Strategy to Neutralize Black Box Adversarial Attackscited by 0
  19. 2026ReACT-CLIP: Response-Aware Test-Time Defense for Vision--Language Modelscited by 0