mlsanityData to 7 Oct 2026

Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them

arXiv 2107.11630 ↗First posted 24 Jul 2021cs.LG cs.CR stat.MLcited by 46

Not on the map. Why?

Abstract (arXiv)

Making classifiers robust to adversarial examples is hard. Thus, many defenses tackle the seemingly easier task of detecting perturbed inputs. We show a barrier towards this goal. We prove a general hardness reduction between detection and classification of adversarial examples: given a robust detector for attacks at distance ε (in some metric), we can build a similarly robust (but inefficient) classifier for attacks at distance ε/2. Our reduction is computationally inefficient, and thus cannot be used to build practical classifiers. Instead, it is a useful sanity check to test whether empirical detection results imply something much stronger than the authors presumably anticipated. To illustrate, we revisit 13 detector defenses. For 11/13 cases, we show that the claimed detection results would imply an inefficient classifier with robustness far beyond the state-of-the-art.

Key facts. Cited by 46 papers in the map (data through 7 Oct 2026). Builds on 40 of its 48 references that are in the map. First posted on arXiv 24 Jul 2021.

Builds on

40 of 48 references.

References · 40

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  4. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,472
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2018Robustness May Be at Odds with Accuracycited by 873
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  9. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  10. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  11. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  12. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
28 more
  1. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  2. 2017Adversarial Patchcited by 514
  3. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  4. 2019On Evaluating Adversarial Robustnesscited by 442
  5. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  6. 2018Adversarially Robust Generalization Requires More Datacited by 318
  7. 2018Certified Defenses against Adversarial Examplescited by 305
  8. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  9. 2017Detecting Adversarial Samples from Artifactscited by 244
  10. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  11. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  12. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  13. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  14. 2019Are Labels Required for Improving Adversarial Robustness?cited by 162
  15. 2020Certified Defenses for Adversarial Patchescited by 100
  16. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  17. 2019The Odds are Odd: A Statistical Test for Detecting Adversarial Examplescited by 75
  18. 2019Adversarially Robust Generalization Just Requires More Unlabeled Datacited by 75
  19. 2019A New Defense Against Adversarial Images: Turning a Weakness into a Strengthcited by 49
  20. 2016Early Methods for Detecting Adversarial Imagescited by 36
  21. 2018Are Generative Classifiers More Robust to Adversarial Attacks?cited by 36
  22. 2017Adversarial Example Defenses: Ensembles of Weak Defenses are not Strongcited by 32
  23. 2020A General Framework For Detecting Anomalous Inputs to DNN Classifierscited by 24
  24. 2019GAT: Generative Adversarial Training for Adversarial Example Detection and Robust Classificationcited by 20
  25. 2019Adversarially Robust Learning Could Leverage Computational Hardnesscited by 13
  26. 2018Adversarial Examples from Cryptographic Pseudo-Random Generatorscited by 10
  27. 2017When Not to Classify: Anomaly Detection of Attacks (ADA) on DNN Classifiers at Test Timecited by 9
  28. 2019Attribution-driven Causal Analysis for Detection of Adversarial Examplescited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 5; 2023: 19; 2024: 12; 2025: 5; 2026: 3.

46 papers.

Sort:

By area:

  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  2. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  3. 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversationscited by 118
  4. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 102
  5. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Roboticscited by 68
  6. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  7. 2023From Robustness to Explainability and Back Againcited by 14
  8. 2024Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifierscited by 10
  9. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Modelscited by 9
  10. 2022A Manifold Two-Sample Test Study: Integral Probability Metric with Neural Networkscited by 5
  11. 2022Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learningcited by 5
  12. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
34 more
  1. 2022Improving Adversarial Robustness via Joint Classification and Multiple Explicit Detection Classescited by 4
  2. 2023Stratified Adversarial Robustness with Rejectioncited by 4
  3. 2023Beyond Labeling Oracles: What does it mean to steal ML models?cited by 4
  4. 2023Splitting the Difference on Adversarial Trainingcited by 4
  5. 2024The Uncanny Valley: Exploring Adversarial Robustness from a Flatness Perspectivecited by 4
  6. 2024Towards Robust Vision Transformer via Masked Adaptive Ensemblecited by 4
  7. 2022Publishing Efficient On-device Models Increases Adversarial Vulnerabilitycited by 3
  8. 2023Robust Proxy: Improving Adversarial Robustness by Robust Proxy Learningcited by 3
  9. 2023HoSNN: Adversarially-Robust Homeostatic Spiking Neural Networks with Adaptive Firing Thresholdscited by 3
  10. 2023Evaluation of Parameter-based Attacks against Embedded Neural Networks with Laser Injectioncited by 2
  11. 2024PASA: Attack Agnostic Unsupervised Adversarial Detection using Prediction & Attribution Sensitivity Analysiscited by 2
  12. 2024Attacking Bayes: On the Adversarial Robustness of Bayesian Neural Networkscited by 2
  13. 2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2
  14. 2023A Comprehensive Assessment Benchmark for Rigorously Evaluating Deep Learning Image Classifierscited by 1
  15. 2023Is Certifying ℓp Robustness Still Worthwhile?cited by 1
  16. 2023Fight Fire with Fire: Combating Adversarial Patch Attacks using Pattern-randomized Defensive Patchescited by 1
  17. 2023Breaking Boundaries: Balancing Performance and Robustness in Deep Wireless Traffic Forecastingcited by 1
  18. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  19. 2024Detecting Adversarial Data using Perturbation Forgerycited by 1
  20. 2024Low-Quality Image Detection by Hierarchical VAEcited by 1
  21. 2025A Cryptographic Perspective on Mitigation vs. Detection in Machine Learningcited by 1
  22. 2021Detecting Adversaries, yet Faltering to Noise? Leveraging Conditional Variational AutoEncoders for Adversary Detection in the Presence of Noisy Imagescited by 0
  23. 2022Gradient Aligned Attacks via a Few Queriescited by 0
  24. 2023A Minimax Approach Against Multi-Armed Adversarial Attacks Detectioncited by 0
  25. 2023Simultaneous Adversarial Attacks On Multiple Face Recognition System Componentscited by 0
  26. 2023Two Heads are Actually Better than One: Towards Better Adversarial Robustness via Transduction and Rejectioncited by 0
  27. 2023The Ultimate Combo: Boosting Adversarial Example Transferability by Composing Data Augmentationscited by 0
  28. 2024Detection of Synthetic Face Images: Accuracy, Robustness, Generalizationcited by 0
  29. 2025Spiking Neural Network: a low power solution for physical layer authenticationcited by 0
  30. 2025AI Security Map: Holistic Organization of AI Security Technologies and Impacts on Stakeholderscited by 0
  31. 2025FeatureLens: A Highly Generalizable and Interpretable Framework for Detecting Adversarial Examples Based on Image Featurescited by 0
  32. 2026AD2: Analysis and Detection of Adversarial Threats in Visual Perception for End-to-End Autonomous Driving Systemscited by 0
  33. 2026Privacy-Preserving Machine Learning for IoT: A Cross-Paradigm Survey and Future Roadmapcited by 0
  34. 2026USAD: Uncertainty-aware Statistical Adversarial Detectioncited by 0