mlsanityData to 7 Oct 2026

Can Adversarial Training Be Manipulated By Non-Robust Features?

arXiv 2201.13329 ↗First posted 31 Jan 2022cs.LG cs.CRcited by 12

Not on the map. Why?

Abstract (arXiv)

Adversarial training, originally designed to resist test-time adversarial examples, has shown to be promising in mitigating training-time availability attacks. This defense ability, however, is challenged in this paper. We identify a novel threat model named stability attack, which aims to hinder robust availability by slightly manipulating the training data. Under this threat, we show that adversarial training using a conventional defense budget ε provably fails to provide test robustness in a simple statistical setting, where the non-robust features of the training data can be reinforced by ε-bounded perturbation. Further, we analyze the necessity of enlarging the defense budget to counter stability attacks. Finally, comprehensive experiments demonstrate that stability attacks are harmful on benchmark datasets, and thus the adaptive defense is necessary to maintain robustness. Our code is available at https://github.com/TLMichael/Hypocritical-Perturbation.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 69 of its 102 references that are in the map. First posted on arXiv 31 Jan 2022.

Builds on

69 of 102 references.

References · 69

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  8. 2014Going Deeper with Convolutionscited by 4,231
  9. 2016Wide Residual Networkscited by 3,057
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
38 more
  1. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  2. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2016End to End Learning for Self-Driving Carscited by 1,000
  6. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  7. 2016Adversarial Machine Learning at Scalecited by 934
  8. 2018Robustness May Be at Odds with Accuracycited by 873
  9. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  10. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  11. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  12. 2020Overfitting in adversarially robust deep learningcited by 504
  13. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  14. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  15. 2019Hidden Trigger Backdoor Attackscited by 359
  16. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  17. 2018Adversarially Robust Generalization Requires More Datacited by 318
  18. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  19. 2019Label-Consistent Backdoor Attackscited by 285
  20. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  21. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  22. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  23. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  24. 2020Bag of Tricks for Adversarial Trainingcited by 199
  25. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  26. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  27. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  28. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  29. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  30. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  31. 2020Understanding and Mitigating the Tradeoff Between Robustness and Accuracycited by 148
  32. 2020To be Robust or to be Fair: Towards Fairness in Adversarial Trainingcited by 137
  33. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  34. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  35. 2021Adversarial Examples Make Strong Poisonscited by 115
  36. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  37. 2018Is feature selection secure against training data poisoning?cited by 88
  38. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86

50 most cited of 69 All 69 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 7; 2025: 0; 2026: 1.

12 papers.

  1. 2023Adversarial Examples Are Not Real Featurescited by 16
  2. 2023Average of Pruning: Improving Performance and Stability of Out-of-Distribution Detectioncited by 14
  3. 2023Detection and Defense of Unlearnable Examplescited by 13
  4. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  5. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  6. 2024Adversarial Training: A Surveycited by 6
  7. 2024Nonlinear Transformations Against Unlearnable Datasetscited by 5
  8. 2024Data-Dependent Stability Analysis of Adversarial Trainingcited by 4
  9. 2023What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?cited by 3
  10. 2024Theoretical Understanding of Learning from Adversarial Perturbationscited by 2
  11. 2024Deferred Poisoning: Making the Model More Vulnerable via Hessian Singularizationcited by 0
  12. 2026Suppress and Diversify: Refining Robust Pathways for Corruption Robustnesscited by 0