# ATRAS: Adversarially Trained Robust Architecture Search

arXiv: https://arxiv.org/abs/2106.06917 · HTML: https://mlsanity.com/paper/2106.06917/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 19 references that are in the map.
- First posted on arXiv 13 Jun 2021.

## Builds on (most cited first, 14 of 14)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Adversarial Training for Free!](https://mlsanity.com/paper/1904.12843/) (2019)
- [On Adaptive Attacks to Adversarial Example Defenses](https://mlsanity.com/paper/2002.08347/) (2020)
- [Adversarial Logit Pairing](https://mlsanity.com/paper/1803.06373/) (2018)
- [Deep Sparse Coding for Invariant Multimodal Halle Berry Neurons](https://mlsanity.com/paper/1711.07998/) (2017)
- [Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain](https://mlsanity.com/paper/2001.11137/) (2020)
- [Machine-learned metrics for predicting the likelihood of success in materials discovery](https://mlsanity.com/paper/1911.11201/) (2019)
- [Perfecting the Crime Machine](https://mlsanity.com/paper/2001.09764/) (2020)
- [Adversarial Attacks against Neural Networks in Audio Domain: Exploiting Principal Components](https://mlsanity.com/paper/2007.07001/) (2020)
- [Evaluating Online and Offline Accuracy Traversal Algorithms for k-Complete Neural Network Architectures](https://mlsanity.com/paper/2101.06518/) (2021)
- [Robust SleepNets](https://mlsanity.com/paper/2102.12555/) (2021)

## Built on by (most cited first, 1 of 1)

- [Bi-fidelity Evolutionary Multiobjective Search for Adversarially Robust Deep Neural Architectures](https://mlsanity.com/paper/2207.05321/) (2022)

## Abstract (arXiv)

In this paper, we explore the effect of architecture completeness on adversarial robustness. We train models with different architectures on CIFAR-10 and MNIST dataset. For each model, we vary different number of layers and different number of nodes in the layer. For every architecture candidate, we use Fast Gradient Sign Method (FGSM) to generate untargeted adversarial attacks and use adversarial training to defend against those attacks. For each architecture candidate, we report pre-attack, post-attack and post-defense accuracy for the model as well as the architecture parameters and the impact of completeness to the model accuracies.