mlsanityData to 7 Oct 2026

Towards Defending against Adversarial Examples via Attack-Invariant Features

arXiv 2106.05036 ↗First posted 9 Jun 2021cs.CVcited by 25

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are vulnerable to adversarial noise. Their adversarial robustness can be improved by exploiting adversarial examples. However, given the continuously evolving attacks, models trained on seen types of adversarial examples generally cannot generalize well to unseen types of adversarial examples. To solve this problem, in this paper, we propose to remove adversarial noise by learning generalizable invariant features across attacks which maintain semantic classification information. Specifically, we introduce an adversarial feature learning mechanism to disentangle invariant features from adversarial noise. A normalization term has been proposed in the encoded space of the attack-invariant features to address the bias issue between the seen and unseen types of attacks. Empirical evaluations demonstrate that our method could provide better protection in comparison to previous state-of-the-art approaches, especially against unseen types of attacks and adaptive attacks.

Key facts. Cited by 25 papers in the map (data through 7 Oct 2026). Builds on 29 of its 43 references that are in the map. First posted on arXiv 9 Jun 2021.

Builds on

29 of 43 references.

References · 29

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Mask R-CNNcited by 7,259
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2013Auto-Encoding Variational Bayescited by 3,980
  8. 2016Wide Residual Networkscited by 3,057
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2014Sequence to Sequence Learning with Neural Networkscited by 2,974
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
17 more
  1. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  2. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  3. 2015Autoencoding beyond pixels using a learned similarity metriccited by 407
  4. 2015Adversarial Autoencoderscited by 359
  5. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  6. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  7. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  8. 2019Are Anchor Points Really Indispensable in Label-Noise Learning?cited by 208
  9. 2018Spatially Transformed Adversarial Examplescited by 195
  10. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  11. 2019advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchcited by 69
  12. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  13. 2017APE-GAN: Adversarial Perturbation Elimination with GANcited by 57
  14. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  15. 2017Towards Deeper Understanding of Variational Autoencoding Modelscited by 56
  16. 2017MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examplescited by 46
  17. 2020Stronger and Faster Wasserstein Adversarial Attackscited by 25

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 6; 2023: 5; 2024: 8; 2025: 3; 2026: 1.

25 papers.

Sort:

By area:

  1. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
  2. 2022Harnessing Out-Of-Distribution Examples via Augmenting Content and Stylecited by 43
  3. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  4. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectorscited by 26
  5. 2022Recognizing Object by Components with Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networkscited by 18
  6. 2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 16
  7. 2022Improving Adversarial Robustness via Mutual Information Estimationcited by 13
  8. 2021Modeling Adversarial Noise for Adversarial Trainingcited by 8
  9. 2024DD-RobustBench: An Adversarial Robustness Benchmark for Dataset Distillationcited by 8
  10. 2026DeepResearch-9K: A Challenging Benchmark Dataset of Deep-Research Agentcited by 8
  11. 2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 7
  12. 2022Self-recoverable Adversarial Examples: A New Effective Protection Mechanism in Social Networkscited by 6
13 more
  1. 2023Bridging Cross-task Protocol Inconsistency for Distillation in Dense Object Detectioncited by 6
  2. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  3. 2023Universal Adversarial Defense in Remote Sensing Based on Pre-trained Denoising Diffusion Modelscited by 5
  4. 2024Meta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attackscited by 5
  5. 2023Exploring Robust Features for Improving Adversarial Robustnesscited by 4
  6. 2025Unveiling Trust in Multimodal Large Language Models: Evaluation, Analysis, and Mitigationcited by 4
  7. 2022Strength-Adaptive Adversarial Trainingcited by 3
  8. 2024Learning Robust and Privacy-Preserving Representations via Information Theorycited by 3
  9. 2024Improving Adversarial Robustness via Decoupled Visual Representation Maskingcited by 2
  10. 2024Enhancing Adversarial Robustness via Uncertainty-Aware Distributional Adversarial Trainingcited by 2
  11. 2025Robustness Feature Adapter for Efficient Adversarial Trainingcited by 2
  12. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  13. 2023Symmetrical Bidirectional Knowledge Alignment for Zero-Shot Sketch-Based Image Retrievalcited by 0