mlsanityData to 7 Oct 2026

Fooling Adversarial Training with Inducing Noise

arXiv 2111.10130 ↗First posted 19 Nov 2021cs.LG cs.CR cs.CVcited by 12

Not on the map. Why?

Abstract (arXiv)

Adversarial training is widely believed to be a reliable approach to improve model robustness against adversarial attack. However, in this paper, we show that when trained on one type of poisoned data, adversarial training can also be fooled to have catastrophic behavior, e.g., <1% robust test accuracy with >90% robust training accuracy on CIFAR-10 dataset. Previously, there are other types of noise poisoned in the training data that have successfully fooled standard training (15.8% standard test accuracy with 99.9% standard training accuracy on CIFAR-10 dataset), but their poisonings can be easily removed when adopting adversarial training. Therefore, we aim to design a new type of inducing noise, named ADVIN, which is an irremovable poisoning of training data. ADVIN can not only degrade the robustness of adversarial training by a large margin, for example, from 51.7% to 0.57% on CIFAR-10 dataset, but also be effective for fooling standard training (13.1% standard test accuracy with 100% standard training accuracy). Additionally, ADVIN can be applied to preventing personal data (like selfies) from being exploited without authorization under whether standard or adversarial training.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 21 of its 26 references that are in the map. First posted on arXiv 19 Nov 2021.

Builds on

21 of 26 references.

References · 21

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
  6. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  9. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  10. 2016Adversarial Machine Learning at Scalecited by 934
  11. 2018Adversarial Attacks and Defences: A Surveycited by 259
  12. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
9 more
  1. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  2. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
  3. 2021Adversarial Examples Make Strong Poisonscited by 115
  4. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
  5. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  6. 2018Bilateral Adversarial Training: Towards Fast Training of More Robust Models Against Adversarial Attackscited by 48
  7. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  8. 2021Analysis and Applications of Class-wise Robustness in Adversarial Trainingcited by 33
  9. 2021Disrupting Model Training with Adversarial Shortcutscited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 4; 2024: 4; 2025: 0; 2026: 1.

12 papers.

  1. 2022Autoregressive Perturbations for Data Poisoningcited by 45
  2. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  3. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  4. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  5. 2022Poisons that are learned faster are more effectivecited by 14
  6. 2023Detection and Defense of Unlearnable Examplescited by 13
  7. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13
  8. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  9. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  10. 2024Nonlinear Transformations Against Unlearnable Datasetscited by 5
  11. 2024Data-Dependent Stability Analysis of Adversarial Trainingcited by 4
  12. 2026SoK: A Comprehensive Analysis of the Current Status of Neural Tangent Generalization Attacks with Research Directionscited by 0