mlsanityData to 7 Oct 2026

Advances in adversarial attacks and defenses in computer vision: A survey

arXiv 2108.00401 ↗First posted 1 Aug 2021cs.CV cs.CR cs.CYcited by 127

Not on the map. Why?

Abstract (arXiv)

Deep Learning (DL) is the most widely used tool in the contemporary field of computer vision. Its ability to accurately solve complex problems is employed in vision research to learn deep neural models for a variety of tasks, including security critical applications. However, it is now known that DL is vulnerable to adversarial attacks that can manipulate its predictions by introducing visually imperceptible perturbations in images and videos. Since the discovery of this phenomenon in 2013~[1], it has attracted significant attention of researchers from multiple sub-fields of machine intelligence. In [2], we reviewed the contributions made by the computer vision community in adversarial attacks on deep learning (and their defenses) until the advent of year 2018. Many of those contributions have inspired new directions in this area, which has matured significantly since witnessing the first generation methods. Hence, as a legacy sequel of [2], this literature review focuses on the advances in this area since 2018. To ensure authenticity, we mainly consider peer-reviewed contributions published in the prestigious sources of computer vision and machine learning research. Besides a comprehensive literature review, the article also provides concise definitions of technical terminologies for non-experts in this domain. Finally, this article discusses challenges and future outlook of this direction based on the literature reviewed herein and [2].

Key facts. Cited by 127 papers in the map (data through 7 Oct 2026). Builds on 336 of its 462 references that are in the map. First posted on arXiv 1 Aug 2021.

Builds on

336 of 462 references.

References · 336

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  6. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  10. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  11. 2013Intriguing properties of neural networkscited by 5,114
  12. 2014Going Deeper with Convolutionscited by 4,231
38 more
  1. 2013Playing Atari with Deep Reinforcement Learningcited by 3,211
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  4. 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,348
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  7. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  8. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  9. 2019Natural Adversarial Examplescited by 1,401
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  13. 2021Transformers in Vision: A Surveycited by 1,009
  14. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  15. 2016Adversarial Machine Learning at Scalecited by 934
  16. 2017Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learningcited by 918
  17. 2014Show and Tell: A Neural Image Caption Generatorcited by 877
  18. 2018Robustness May Be at Odds with Accuracycited by 873
  19. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  20. 2016Universal adversarial perturbationscited by 774
  21. 2018How To Backdoor Federated Learningcited by 745
  22. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  23. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  24. 2017Dynamic Routing Between Capsulescited by 689
  25. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  26. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  27. 2017Federated Multi-Task Learningcited by 669
  28. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  29. 2017One pixel attack for fooling deep neural networkscited by 579
  30. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  31. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  32. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  33. 2017Countering Adversarial Images using Input Transformationscited by 517
  34. 2017Adversarial Patchcited by 514
  35. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  36. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  37. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  38. 2018SiamRPN++: Evolution of Siamese Visual Tracking with Very Deep Networkscited by 445

50 most cited of 336 All 336 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 28; 2023: 38; 2024: 24; 2025: 25; 2026: 9.

127 papers.

Sort:

By area:

  1. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,422
  2. 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Eraserscited by 118
  3. 2022Efficient Diffusion Models for Vision: A Surveycited by 50
  4. 2023BAGM: A Backdoor Attack for Manipulating Text-to-Image Generative Modelscited by 37
  5. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 34
  6. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  7. 2023Survey on Unsupervised Domain Adaptation for Semantic Segmentation for Visual Perception in Automated Drivingcited by 29
  8. 2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
  9. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  10. 2024Speech Robust Bench: A Robustness Benchmark For Speech Recognitioncited by 20
  11. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  12. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
38 more
  1. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  2. 2022FaceQAN: Face Image Quality Assessment Through Adversarial Noise Explorationcited by 17
  3. 2023Dual Student Networks for Data-Free Model Stealingcited by 17
  4. 2025T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Modelscited by 17
  5. 2023Quantifying Bias in Text-to-Image Generative Modelscited by 16
  6. 2024Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspectivecited by 15
  7. 2023A Review of the Role of Causality in Developing Trustworthy AI Systemscited by 14
  8. 2023Understanding and Improving Ensemble Adversarial Defensecited by 14
  9. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  10. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  11. 2023Hard No-Box Adversarial Attack on Skeleton-Based Human Action Recognition with Skeleton-Motion-Informed Gradientcited by 10
  12. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  13. 2022Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Framecited by 9
  14. 2023It Is All About Data: A Survey on the Effects of Data on Adversarial Robustnesscited by 9
  15. 2023Targeted Adversarial Attacks on Wind Power Forecastscited by 9
  16. 2022Defending Black-box Skeleton-based Human Activity Classifierscited by 8
  17. 2022Generating and Detecting True Ambiguity: A Forgotten Danger in DNN Supervision Testingcited by 8
  18. 2023State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systemscited by 8
  19. 2022A Hybrid CNN-LSTM model for Video Deepfake Detection by Leveraging Optical Flow Featurescited by 7
  20. 2023Expressive Monotonic Neural Networkscited by 7
  21. 2024A Survey on Failure Analysis and Fault Injection in AI Systemscited by 7
  22. 2025Shh, don't say that! Domain Certification in LLMscited by 7
  23. 2025State-Aware Perturbation Optimization for Robust Deep Reinforcement Learningcited by 7
  24. 2025Robust Deep Reinforcement Learning in Robotics via Adaptive Gradient-Masked Adversarial Attackscited by 7
  25. 2022Backdoor Attacks for Remote Sensing Data with Wavelet Transformcited by 6
  26. 2023Provable Unrestricted Adversarial Training without Compromise with Generalizabilitycited by 6
  27. 2023Evading Forensic Classifiers with Attribute-Conditioned Adversarial Facescited by 6
  28. 2023SWAP: Exploiting Second-Ranked Logits for Adversarial Attacks on Time Seriescited by 6
  29. 2024Towards Physically Realizable Adversarial Attacks in Embodied Vision Navigationcited by 6
  30. 2021All You Need is RAW: Defending Against Adversarial Attacks with Camera Image Pipelinescited by 5
  31. 2022Rethinking Textual Adversarial Defense for Pre-trained Language Modelscited by 5
  32. 2022On the Robustness of Explanations of Deep Neural Network Models: A Surveycited by 5
  33. 2023Meta Generative Attack on Person Reidentificationcited by 5
  34. 2023Implementing Responsible AI: Tensions and Trade-Offs Between Ethics Aspectscited by 5
  35. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  36. 2023Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Surveycited by 5
  37. 2023Universal Adversarial Defense in Remote Sensing Based on Pre-trained Denoising Diffusion Modelscited by 5
  38. 2025A Survey on Unlearnable Datacited by 5

50 most cited of 127 All 127 (JSON)