mlsanityData to 14 Oct 2026

Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations

arXiv 2202.04235 ↗First posted 9 Feb 2022cs.CVcited by 26

Not on the map. Why?

Abstract (arXiv)

Model robustness against adversarial examples of single perturbation type such as the ℓp-norm has been widely studied, yet its generalization to more realistic scenarios involving multiple semantic perturbations and their composition remains largely unexplored. In this paper, we first propose a novel method for generating composite adversarial examples. Our method can find the optimal attack composition by utilizing component-wise projected gradient descent and automatic attack-order scheduling. We then propose generalized adversarial training (GAT) to extend model robustness from ℓp-ball to composite semantic perturbations, such as the combination of Hue, Saturation, Brightness, Contrast, and Rotation. Results obtained using ImageNet and CIFAR-10 datasets indicate that GAT can be robust not only to all the tested types of a single attack, but also to any combination of such attacks. GAT also outperforms baseline ℓ∞-norm bounded adversarial training approaches by a significant margin.

Key facts. Cited by 26 papers in the map (data through 14 Oct 2026). Builds on 42 of its 61 references that are in the map. First posted on arXiv 9 Feb 2022.

Builds on

42 of 61 references.

References · 42

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2016Wide Residual Networkscited by 3,070
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  9. 2013Sinkhorn Distances: Lightspeed Computation of Optimal Transportation Distancescited by 2,316
  10. 2016Adversarial examples in the physical worldcited by 1,769
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
30 more
  1. 2016Adversarial Machine Learning at Scalecited by 936
  2. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  3. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  4. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  5. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
  6. 2019Kornia: an Open Source Differentiable Computer Vision Library for PyTorchcited by 232
  7. 2017Near-linear time approximation algorithms for optimal transport via Sinkhorn iterationcited by 223
  8. 2018Spatially Transformed Adversarial Examplescited by 195
  9. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
  10. 2018Learning Latent Permutations with Gumbel-Sinkhorn Networkscited by 175
  11. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 155
  12. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  13. 2021Towards Robust Vision Transformercited by 137
  14. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  15. 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
  16. 2019ColorFool: Semantic Adversarial Colorizationcited by 89
  17. 2019Adversarial Robustness Against the Union of Multiple Perturbation Modelscited by 88
  18. 2018Semantic Adversarial Examplescited by 86
  19. 2019Unrestricted Adversarial Examples via Semantic Manipulationcited by 84
  20. 2019Functional Adversarial Attackscited by 82
  21. 2019Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifierscited by 57
  22. 2019Adversarial Attack Generation Empowered by Min-Max Optimizationcited by 32
  23. 2020Composite Adversarial Attackscited by 29
  24. 2021Towards Defending against Adversarial Examples via Attack-Invariant Featurescited by 25
  25. 2021Adaptive Image Transformations for Transfer-based Adversarial Attackcited by 22
  26. 2017Attacking the Madry Defense Model with L1-based Adversarial Examplescited by 21
  27. 2013Bregman Alternating Direction Method of Multiplierscited by 19
  28. 2021Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similaritycited by 18
  29. 2019Quantifying Perceptual Distortion of Adversarial Examplescited by 10
  30. 2020Generating Semantic Adversarial Examples via Feature Manipulationcited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 3; 2023: 9; 2024: 5; 2025: 6; 2026: 3.

26 papers.

Sort:

By area:

  1. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
  2. 2022Holistic Adversarial Robustness of Deep Learning Modelscited by 11
  3. 2023MultiRobustBench: Benchmarking Robustness Against Multiple Attackscited by 7
  4. 2023Assessing Robustness via Score-Based Adversarial Image Generationcited by 6
  5. 2024Adversarial Training: A Surveycited by 6
  6. 2022CARBEN: Composite Adversarial Robustness Benchmarkcited by 5
  7. 2023OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shiftcited by 4
  8. 2022A Closer Look at Robustness to L-infinity and Spatial Perturbations and their Compositioncited by 2
  9. 2023Efficient Search of Comprehensively Robust Neural Architectures via Multi-fidelity Evaluationcited by 2
  10. 2024Artificial Immune System of Secure Face Recognition Against Adversarial Attackscited by 2
  11. 2024Non-Uniform Illumination Attack for Fooling Convolutional Neural Networkscited by 2
  12. 2023Rapid Plug-in Defenderscited by 1
14 more
  1. 2023Microbial Genetic Algorithm-based Black-box Attack against Interpretable Deep Learning Systemscited by 1
  2. 2023Is Certifying ℓp Robustness Still Worthwhile?cited by 1
  3. 2024Position: Towards Resilience Against Adversarial Examplescited by 1
  4. 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
  5. 2025CIARD: Cyclic Iterative Adversarial Robustness Distillationcited by 1
  6. 2025The Impact of Scaling Training Data on Adversarial Robustnesscited by 1
  7. 2026Compositional Adversarial Training for Robust Visual Watermarkingcited by 1
  8. 2023Multi-objective Evolutionary Search of Variable-length Composite Semantic Perturbationscited by 0
  9. 2023General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothingcited by 0
  10. 2025Diffusion or Non-Diffusion Adversarial Defenses: Rethinking the Relation between Classifier and Adversarial Purifiercited by 0
  11. 2025FERD: Fairness-Enhanced Data-Free Robustness Distillationcited by 0
  12. 2025Stabilizing Multi-Attack Adversarial Training via Bandit Optimizationcited by 0
  13. 2026Brain Tumor Classifiers Under Attack: Robustness of ResNet Variants Against Transferable FGSM and PGD Attackscited by 0
  14. 2026Lipschitz Optimization for Formal Verification of Homographiescited by 0