Data to 14 Oct 2026

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

arXiv 2202.13711 ↗First posted 28 Feb 2022cs.LG cs.CR cs.CVcited by 64

Not on the map. Why?

Abstract (arXiv)

Adaptive defenses, which optimize at test time, promise to improve adversarial robustness. We categorize such adaptive test-time defenses, explain their potential benefits and drawbacks, and evaluate a representative variety of the latest adaptive defenses for image classification. Unfortunately, none significantly improve upon static defenses when subjected to our careful case study evaluation. Some even weaken the underlying static model while simultaneously increasing inference computation. While these results are disappointing, we still believe that adaptive test-time defenses are a promising avenue of research and, as such, we provide recommendations for their thorough evaluation. We extend the checklist of Carlini et al. (2019) by providing concrete steps specific to adaptive defenses.

Key facts. Cited by 64 papers in the map (data through 14 Oct 2026). Builds on 49 of its 66 references that are in the map. First posted on arXiv 28 Feb 2022.

Builds on

49 of 66 references.

References · 49

2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
2013Intriguing properties of neural networkscited by 5,155
2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
2016Adversarial examples in the physical worldcited by 1,769
2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
2020Improved Techniques for Training Score-Based Generative Modelscited by 1,043
2017Evasion Attacks against Machine Learning at Test Timecited by 689
2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685

37 more

2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
2020On Adaptive Attacks to Adversarial Example Defensescited by 555
2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
2017Countering Adversarial Images using Input Transformationscited by 520
2020Overfitting in adversarially robust deep learningcited by 506
2019On Evaluating Adversarial Robustnesscited by 447
2019Unlabeled Data Improves Adversarial Robustnesscited by 416
2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 278
2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
2021Improving Robustness using Generated Datacited by 234
2018Adversarial Logit Pairingcited by 224
2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
2020Understanding and Improving Fast Adversarial Trainingcited by 214
2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
2021Adversarial purification with Score-based generative modelscited by 134
2018Towards the first adversarially robust neural network model on MNISTcited by 104
2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
2020Tent: Fully Test-time Adaptation by Entropy Minimizationcited by 69
2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
2021Online Adversarial Purification based on Self-Supervisioncited by 46
2018Are Generative Classifiers More Robust to Adversarial Attacks?cited by 36
2021Attacking Adversarial Attacks as A Defensecited by 32
2021Combating Adversaries with Anti-Adversariescited by 27
2021Towards Robust Neural Networks via Close-loop Controlcited by 23
2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 20
2021Joint inference and input optimization in equilibrium networkscited by 15
2020Tailoring: encoding inductive biases by optimizing unsupervised objectives at prediction timecited by 13
2021AID-Purifier: A Light Auxiliary Network for Boosting Adversarial Defensecited by 10
2021Improving Model Robustness with Latent Distribution Locally and Globallycited by 9
2021Towards Evaluating the Robustness of Neural Networks Learned by Transductioncited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 11; 2023: 22; 2024: 16; 2025: 8; 2026: 7.

64 papers.

Sort:

By area:

2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
2022Diffusion Models for Adversarial Purificationcited by 476
2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 51
2022Visual Prompting for Adversarial Robustnesscited by 34
2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
2023On the Robustness of Open-World Test-Time Training: Self-Training with Dynamic Prototype Expansioncited by 34
2022Threat Model-Agnostic Adversarial Defense using Diffusion Modelscited by 24
2025CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIPcited by 23
2023On the Over-Memorization During Natural, Robust and Catastrophic Overfittingcited by 20

38 more

2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
2023Evaluation of Test-Time Adaptation Under Computational Time Constraintscited by 15
2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 15
2025Enhancing CLIP Robustness via Cross-Modality Alignmentcited by 15
2023Robust Weight Signatures: Gaining Robustness as Easy as Patching Weights?cited by 13
2023Uncovering Adversarial Risks of Test-Time Adaptationcited by 12
2024Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularizationcited by 12
2024Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependencycited by 10
2022Robust Perception through Equivariancecited by 9
2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
2022Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learningcited by 5
2026Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoningcited by 5
2023Test-time Detection and Repair of Adversarial Samples via Masked Autoencodercited by 4
2023OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shiftcited by 4
2023Continual Adversarial Defensecited by 4
2022Towards Alternative Techniques for Improving Adversarial Robustness: Analysis of Adversarial Training at a Spectrum of Perturbationscited by 3
2023Robust Feature Inference: A Test-time Defense Strategy using Spectral Projectionscited by 3
2023MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attackscited by 3
2024Generalized Semi-Supervised Learning via Self-Supervised Feature Adaptationcited by 3
2024Interpretability-Guided Test-Time Adversarial Defensecited by 3
2024Achieving Domain-Independent Certified Robustness via Knowledge Continuitycited by 3
2022Adversarially Robust Video Perception by Seeing Motioncited by 2
2023Improving Adversarial Robustness of DEQs with Explicit Regulations Along the Neural Dynamicscited by 2
2023Computational Asymmetries in Robust Classificationcited by 2
2023Dynamic ensemble selection based on Deep Neural Network Uncertainty Estimation for Adversarial Robustnesscited by 2
2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2
2022Test-time adversarial detection and robustness for localizing humans using ultra wide band channel impulse responsescited by 1
2023On Evaluating the Adversarial Robustness of Semantic Segmentation Modelscited by 1
2023Is Certifying ℓp Robustness Still Worthwhile?cited by 1
2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
2024Adaptive Batch Normalization Networks for Adversarial Robustnesscited by 1
2024Robust width: A lightweight and certifiable adversarial defensecited by 1
2024Improving Adversarial Robustness via Feature Pattern Consistency Constraintcited by 1
2024Evaluating the Adversarial Robustness of Semantic Segmentation: Trying Harder Pays Offcited by 1
2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
2025Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defensecited by 1
2025ADVMEM: Adversarial Memory Initialization for Realistic Test-Time Adaptation via Tracklet-Based Benchmarkingcited by 1
2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1

50 most cited of 64 All 64 (JSON)