# Adversarial Robustness for Unsupervised Domain Adaptation

arXiv: https://arxiv.org/abs/2109.00946 · HTML: https://mlsanity.com/paper/2109.00946/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- Builds on 43 of its 59 references that are in the map.
- First posted on arXiv 2 Sep 2021.

## Builds on (most cited first, 30 of 43)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Distilling the Knowledge in a Neural Network](https://mlsanity.com/paper/1503.02531/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Domain-Adversarial Training of Neural Networks](https://mlsanity.com/paper/1505.07818/) (2015)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [FitNets: Hints for Thin Deep Nets](https://mlsanity.com/paper/1412.6550/) (2014)
- [Learning Transferable Features with Deep Adaptation Networks](https://mlsanity.com/paper/1502.02791/) (2015)
- [Deep Hashing Network for Unsupervised Domain Adaptation](https://mlsanity.com/paper/1706.07522/) (2017)
- [Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfer](https://mlsanity.com/paper/1612.03928/) (2016)
- [Deeper, Broader and Artier Domain Generalization](https://mlsanity.com/paper/1710.03077/) (2017)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Fast is better than free: Revisiting adversarial training](https://mlsanity.com/paper/2001.03994/) (2020)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Adversarial Training for Free!](https://mlsanity.com/paper/1904.12843/) (2019)
- [Deep Transfer Learning with Joint Adaptation Networks](https://mlsanity.com/paper/1605.06636/) (2016)
- [Do Better ImageNet Models Transfer Better?](https://mlsanity.com/paper/1805.08974/) (2018)
- [Countering Adversarial Images using Input Transformations](https://mlsanity.com/paper/1711.00117/) (2017)
- [Similarity-Preserving Knowledge Distillation](https://mlsanity.com/paper/1907.09682/) (2019)
- [Domain Generalization by Solving Jigsaw Puzzles](https://mlsanity.com/paper/1903.06864/) (2019)
- [VisDA: The Visual Domain Adaptation Challenge](https://mlsanity.com/paper/1710.06924/) (2017)
- [Using Pre-Training Can Improve Model Robustness and Uncertainty](https://mlsanity.com/paper/1901.09960/) (2019)
- [Bridging Theory and Algorithm for Domain Adaptation](https://mlsanity.com/paper/1904.05801/) (2019)
- [Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser](https://mlsanity.com/paper/1712.02976/) (2017)
- [Do Adversarially Robust ImageNet Models Transfer Better?](https://mlsanity.com/paper/2007.08489/) (2020)
- [Learning to Learn Single Domain Generalization](https://mlsanity.com/paper/2003.13216/) (2020)
- [Learning to Generate Novel Domains for Domain Generalization](https://mlsanity.com/paper/2007.03304/) (2020)

## Built on by (most cited first, 24 of 24)

- [Self-Supervised Contrastive Pre-Training For Time Series via Time-Frequency Consistency](https://mlsanity.com/paper/2206.08496/) (2022)
- [Balancing Discriminability and Transferability for Source-Free Domain Adaptation](https://mlsanity.com/paper/2206.08009/) (2022)
- [DecoupleNet: Decoupled Network for Domain Adaptive Semantic Segmentation](https://mlsanity.com/paper/2207.09988/) (2022)
- [Concurrent Subsidiary Supervision for Unsupervised Source-Free Domain Adaptation](https://mlsanity.com/paper/2207.13247/) (2022)
- [MixACM: Mixup-Based Robustness Transfer via Distillation of Activated Channel Maps](https://mlsanity.com/paper/2111.05073/) (2021)
- [Adaptive Betweenness Clustering for Semi-Supervised Domain Adaptation](https://mlsanity.com/paper/2401.11448/) (2024)
- [Exploring Adversarially Robust Training for Unsupervised Domain Adaptation](https://mlsanity.com/paper/2202.09300/) (2022)
- [Epistemic Artificial Intelligence is Essential for Machine Learning Models to Truly 'Know When They Do Not Know'](https://mlsanity.com/paper/2505.04950/) (2025)
- [SRoUDA: Meta Self-training for Robust Unsupervised Domain Adaptation](https://mlsanity.com/paper/2212.05917/) (2022)
- [Towards Robust 3D Pose Transfer with Adversarial Learning](https://mlsanity.com/paper/2404.02242/) (2024)
- [DALI: Domain Adaptive LiDAR Object Detection via Distribution-level and Instance-level Pseudo Label Denoising](https://mlsanity.com/paper/2412.08806/) (2024)
- [AdaptGuard: Defending Against Universal Attacks for Model Adaptation](https://mlsanity.com/paper/2303.10594/) (2023)
- [Unsupervised Robust Domain Adaptation: Paradigm, Theory and Algorithm](https://mlsanity.com/paper/2511.11009/) (2025)
- [QAGAN: Adversarial Approach To Learning Domain Invariant Language Features](https://mlsanity.com/paper/2206.12388/) (2022)
- [Adversarial Bi-Regressor Network for Domain Adaptive Regression](https://mlsanity.com/paper/2209.09943/) (2022)
- [FROD: Robust Object Detection for Free](https://mlsanity.com/paper/2308.01888/) (2023)
- [A Class-aware Optimal Transport Approach with Higher-Order Moment Matching for Unsupervised Domain Adaptation](https://mlsanity.com/paper/2401.15952/) (2024)
- [DART: A Principled Approach to Adversarially Robust Unsupervised Domain Adaptation](https://mlsanity.com/paper/2402.11120/) (2024)
- [TAROT: Towards Essentially Domain-Invariant Robustness with Theoretical Justification](https://mlsanity.com/paper/2505.06580/) (2025)
- [DAD++: Improved Data-free Test Time Adversarial Defense](https://mlsanity.com/paper/2309.05132/) (2023)
- [Cooperative Students: Navigating Unsupervised Domain Adaptation in Nighttime Object Detection](https://mlsanity.com/paper/2404.01988/) (2024)
- [Towards Trustworthy Unsupervised Domain Adaptation: A Representation Learning Perspective for Enhancing Robustness, Discrimination, and Generalization](https://mlsanity.com/paper/2406.13180/) (2024)
- [Overlap-Aware Feature Learning for Robust Unsupervised Domain Adaptation for 3D Semantic Segmentation](https://mlsanity.com/paper/2504.01668/) (2025)
- [Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillation](https://mlsanity.com/paper/2512.10275/) (2025)

## Abstract (arXiv)

Extensive Unsupervised Domain Adaptation (UDA) studies have shown great success in practice by learning transferable representations across a labeled source domain and an unlabeled target domain with deep models. However, previous works focus on improving the generalization ability of UDA models on clean examples without considering the adversarial robustness, which is crucial in real-world applications. Conventional adversarial training methods are not suitable for the adversarial robustness on the unlabeled target domain of UDA since they train models with adversarial examples generated by the supervised loss function. In this work, we leverage intermediate representations learned by multiple robust ImageNet models to improve the robustness of UDA models. Our method works by aligning the features of the UDA model with the robust features learned by ImageNet pre-trained models along with domain adaptation training. It utilizes both labeled and unlabeled domains and instills robustness without any adversarial intervention or label requirement during domain adaptation training. Experimental results show that our method significantly improves adversarial robustness compared to the baseline while keeping clean accuracy on various UDA benchmarks.