mlsanityData to 7 Oct 2026

Towards Understanding the Generative Capability of Adversarially Robust Classifiers

arXiv 2108.09093 ↗First posted 20 Aug 2021cs.LG cs.CVcited by 26

Not on the map. Why?

Abstract (arXiv)

Recently, some works found an interesting phenomenon that adversarially robust classifiers can generate good images comparable to generative models. We investigate this phenomenon from an energy perspective and provide a novel explanation. We reformulate adversarial example generation, adversarial training, and image generation in terms of an energy function. We find that adversarial training contributes to obtaining an energy function that is flat and has low energy around the real data, which is the key for generative capability. Based on our new understanding, we further propose a better adversarial training method, Joint Energy Adversarial Training (JEAT), which can generate high-quality images and achieve new state-of-the-art robustness under a wide range of attacks. The Inception Score of the images (CIFAR-10) generated by JEAT is 8.80, much better than original robust classifiers (7.50).

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Builds on 24 of its 39 references that are in the map. First posted on arXiv 20 Aug 2021.

Builds on

24 of 39 references.

References · 24

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2017On Calibration of Modern Neural Networkscited by 4,860
  5. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2018Glow: Generative Flow with Invertible 1x1 Convolutionscited by 1,539
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  11. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  12. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
12 more
  1. 2019Adversarial Training for Free!cited by 638
  2. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  3. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
  4. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  5. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  6. 2019Learning Non-Convergent Non-Persistent Short-Run MCMC Toward Energy-Based Modelcited by 147
  7. 2019Implicit Semantic Data Augmentation for Deep Networkscited by 106
  8. 2020Smooth Adversarial Trainingcited by 89
  9. 2019NeuTra-lizing Bad Geometry in Hamiltonian Monte Carlo Using Neural Transportcited by 73
  10. 2019Maximum Entropy Generators for Energy-Based Modelscited by 55
  11. 2019Exponential Family Estimation via Adversarial Dynamics Embeddingcited by 30
  12. 2019Implicit Generation and Generalization in Energy-Based Modelscited by 21

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 5; 2023: 9; 2024: 2; 2025: 6; 2026: 1.

26 papers.

Sort:

By area:

  1. 2021Unsolved Problems in ML Safetycited by 291
  2. 2022Boosting Out-of-distribution Detection with Typical Featurescited by 48
  3. 2023Adversarial Counterfactual Visual Explanationscited by 47
  4. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
  5. 2022Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidancecited by 33
  6. 2021Adversarial Robustness for Unsupervised Domain Adaptationcited by 24
  7. 2023Which Models have Perceptually-Aligned Gradients? An Explanation via Off-Manifold Robustnesscited by 20
  8. 2022Towards Bridging the Performance Gaps of Joint Energy-based Modelscited by 15
  9. 2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
  10. 2021MixACM: Mixup-Based Robustness Transfer via Distillation of Activated Channel Mapscited by 9
  11. 2024Shedding More Light on Robust Classifiers under the lens of Energy-based Modelscited by 9
  12. 2022Defending Black-box Skeleton-based Human Activity Classifierscited by 8
14 more
  1. 2023M-EBM: Towards Understanding the Manifolds of Energy-Based Modelscited by 6
  2. 2023Towards Generalizable Data Protection With Transferable Unlearnable Examplescited by 4
  3. 2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 3
  4. 2024Text-to-Image Generation Via Energy-Based CLIPcited by 3
  5. 2023Exploring the Connection between Robust and Generative Modelscited by 2
  6. 2023FROD: Robust Object Detection for Freecited by 2
  7. 2025Understanding Adversarial Training with Energy-based Modelscited by 2
  8. 2025Concept-based Adversarial Attack: a Probabilistic Perspectivecited by 2
  9. 2025Your Classifier Can Do More: Towards Balancing the Gaps in Classification, Robustness, and Generationcited by 1
  10. 2025Counterfactual Visual Explanation via Causally-Guided Adversarial Steeringcited by 1
  11. 2025Scalable Energy-Based Models via Adversarial Training: Unifying Discrimination and Generationcited by 1
  12. 2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1
  13. 2023Score-based Conditional Generation with Fewer Labeled Data by Self-calibrating Classifier Guidancecited by 0
  14. 2025What is Adversarial Training for Diffusion Models?cited by 0