mlsanityData to 14 Oct 2026

A Review of Adversarial Attack and Defense for Classification Methods

arXiv 2111.09961 ↗First posted 18 Nov 2021cs.CR cs.LGcited by 29

Not on the map. Why?

Abstract (arXiv)

Despite the efficiency and scalability of machine learning systems, recent studies have demonstrated that many classification methods, especially deep neural networks (DNNs), are vulnerable to adversarial examples; i.e., examples that are carefully crafted to fool a well-trained classification model while being indistinguishable from natural data to human. This makes it potentially unsafe to apply DNNs or related methods in security-critical areas. Since this issue was first identified by Biggio et al. (2013) and Szegedy et al.(2014), much work has been done in this field, including the development of attack methods to generate adversarial examples and the construction of defense techniques to guard against such examples. This paper aims to introduce this topic and its latest developments to the statistical community, primarily focusing on the generation and guarding of adversarial examples. Computing codes (in python and R) used in the numerical experiments are publicly available for readers to explore the surveyed methods. It is the hope of the authors that this paper will encourage more statisticians to work on this important and exciting field of generating and defending against adversarial examples.

Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Builds on 82 of its 121 references that are in the map. First posted on arXiv 18 Nov 2021.

Builds on

82 of 121 references.

References · 82

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  8. 2016Adversarial examples in the physical worldcited by 1,769
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  10. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  12. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
38 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  2. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  4. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  5. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  6. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  7. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  8. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  9. 2019Adversarial Training for Free!cited by 643
  10. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
  11. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  12. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  13. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  14. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  15. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  16. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  17. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  18. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  19. 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 351
  20. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
  21. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  22. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
  23. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 278
  24. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  25. 2019Simple Black-box Adversarial Attackscited by 251
  26. 2017Detecting Adversarial Samples from Artifactscited by 245
  27. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  28. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
  29. 2017On Detecting Adversarial Perturbationscited by 232
  30. 2020Bag of Tricks for Adversarial Trainingcited by 200
  31. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 183
  32. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  33. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  34. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 172
  35. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  36. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 159
  37. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 155
  38. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146

50 most cited of 82 All 82 (JSON)

Built on by

Cited by year

Citing papers per year: 2022: 3; 2023: 9; 2024: 13; 2025: 4.

29 papers.

Sort:

By area:

  1. 2023Performance-optimized deep neural networks are evolving into worse models of inferotemporal visual cortexcited by 18
  2. 2023Adversarial robustness of amortized Bayesian inferencecited by 17
  3. 2022TSFool: Crafting Highly-Imperceptible Adversarial Time Series through Multi-Objective Attackcited by 9
  4. 2023Generating Adversarial Attacks in the Latent Spacecited by 8
  5. 2023Implementing Responsible AI: Tensions and Trade-Offs Between Ethics Aspectscited by 6
  6. 2023Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Surveycited by 5
  7. 2023Universal Adversarial Defense in Remote Sensing Based on Pre-trained Denoising Diffusion Modelscited by 5
  8. 2024Benchmarking Transferable Adversarial Attackscited by 5
  9. 2024FIMBA: Evaluating the Robustness of AI in Genomics via Feature Importance Adversarial Attackscited by 4
  10. 2024A Survey of Neural Network Robustness Assessment in Image Recognitioncited by 3
  11. 2025Poisoning Bayesian Inference via Data Deletion and Replicationcited by 3
  12. 2023OMG-ATTACK: Self-Supervised On-Manifold Generation of Transferable Evasion Attackscited by 2
17 more
  1. 2024Multi-Excitation Projective Simulation with a Many-Body Physics Inspired Inductive Biascited by 2
  2. 2024Spectral regularization for adversarially-robust representation learningcited by 2
  3. 2024TF-Attack: Transferable and Fast Adversarial Attacks on Large Language Modelscited by 2
  4. 2022Using adversarial images to improve outcomes of federated learning for non-IID datacited by 1
  5. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  6. 2024Investigating and unmasking feature-level vulnerabilities of CNNs to adversarial perturbationscited by 1
  7. 2024Data Poisoning: An Overlooked Threat to Power Grid Resiliencecited by 1
  8. 20242DSig-Detect: a semi-supervised framework for anomaly detection on image data using 2D-signaturescited by 1
  9. 2025CIARD: Cyclic Iterative Adversarial Robustness Distillationcited by 1
  10. 2022Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategiescited by 0
  11. 2023Federated Composite Saddle Point Optimizationcited by 0
  12. 2023The race to robustness: exploiting fragile models for urban camouflage and the imperative for machine learning securitycited by 0
  13. 2024AdCorDA: Classifier Refinement via Adversarial Correction and Domain Adaptationcited by 0
  14. 2024Logifold: A Geometrical Foundation of Ensemble Machine Learningcited by 0
  15. 2024Pixel-Based Similarities as an Alternative to Neural Data for Improving Convolutional Neural Network Adversarial Robustnesscited by 0
  16. 2025FERD: Fairness-Enhanced Data-Free Robustness Distillationcited by 0
  17. 2025TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Modelscited by 0