mlsanityData to 14 Oct 2026

Do Perceptually Aligned Gradients Imply Adversarial Robustness?

arXiv 2207.11378 ↗First posted 22 Jul 2022cs.CVcited by 15

Not on the map. Why?

Abstract (arXiv)

Adversarially robust classifiers possess a trait that non-robust models do not -- Perceptually Aligned Gradients (PAG). Their gradients with respect to the input align well with human perception. Several works have identified PAG as a byproduct of robust training, but none have considered it as a standalone phenomenon nor studied its own implications. In this work, we focus on this trait and test whether Perceptually Aligned Gradients imply Robustness. To this end, we develop a novel objective to directly promote PAG in training classifiers and examine whether models with such gradients are more robust to adversarial attacks. Extensive experiments on multiple datasets and architectures validate that models with aligned gradients exhibit significant robustness, exposing the surprising bidirectional connection between PAG and robustness. Lastly, we show that better gradient alignment leads to increased robustness and harness this observation to boost the robustness of existing adversarial training techniques.

Key facts. Cited by 15 papers in the map (data through 14 Oct 2026). Builds on 63 of its 83 references that are in the map. First posted on arXiv 22 Jul 2022.

Builds on

63 of 83 references.

References · 63

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  9. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  10. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  12. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
38 more
  1. 2013Intriguing properties of neural networkscited by 5,155
  2. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
  3. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  5. 2016Adversarial examples in the physical worldcited by 1,769
  6. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  8. 2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,446
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  10. 2021Cascaded Diffusion Models for High Fidelity Image Generationcited by 1,163
  11. 2022Denoising Diffusion Restoration Modelscited by 963
  12. 2021Blended Diffusion for Text-driven Editing of Natural Imagescited by 927
  13. 2018Robustness May Be at Odds with Accuracycited by 880
  14. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 776
  15. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  16. 2021Score-based Generative Modeling in Latent Spacecited by 636
  17. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  18. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  19. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  20. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  21. 2018Adversarially Robust Generalization Requires More Datacited by 318
  22. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  23. 2021Unsolved Problems in ML Safetycited by 292
  24. 2021SegDiff: Image Segmentation with Diffusion Probabilistic Modelscited by 280
  25. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  26. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  27. 2020Understanding and Improving Fast Adversarial Trainingcited by 214
  28. 2021More Control for Free! Image Synthesis with Semantic Diffusion Guidancecited by 212
  29. 2021SNIPS: Solving Noisy Inverse Problems Stochasticallycited by 191
  30. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  31. 2019Adversarial Robustness through Local Linearizationcited by 146
  32. 2020Self-Adaptive Training: beyond Empirical Risk Minimizationcited by 126
  33. 2017A Study and Comparison of Human and Deep Learning Recognition Performance Under Visual Distortionscited by 108
  34. 2020Boosting Adversarial Training with Hypersphere Embeddingcited by 97
  35. 2022Lossy Compression with Gaussian Diffusioncited by 90
  36. 2018Improving DNN Robustness to Adversarial Attacks using Jacobian Regularizationcited by 88
  37. 2019On the Connection Between Adversarial Robustness and Saliency Map Interpretabilitycited by 80
  38. 2019Adversarially Robust Generalization Just Requires More Unlabeled Datacited by 76

50 most cited of 63 All 63 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 1; 2024: 3; 2025: 8; 2026: 3.

15 papers.

Sort:

By area:

  1. 2025Compressed Image Generation with Denoising Diffusion Codebook Modelscited by 28
  2. 2023CLIPAG: Towards Generator-Free Text-to-Image Generationcited by 12
  3. 2024Shedding More Light on Robust Classifiers under the lens of Energy-based Modelscited by 9
  4. 2025Adversarial Attacks Leverage Interference Between Features in Superpositioncited by 8
  5. 2025Implicit Inversion turns CLIP into a Decodercited by 4
  6. 2025LeakyCLIP: Extracting Training Data from CLIPcited by 4
  7. 2025Tangentially Aligned Integrated Gradients for User-Friendly Explanationscited by 3
  8. 2024Enhancing Consistency-Based Image Generation via Adversarialy-Trained Classification and Energy-Based Discriminationcited by 2
  9. 2024L-WISE: Boosting Human Visual Category Learning Through Model-Based Image Selection and Enhancementcited by 2
  10. 2025False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systemscited by 2
  11. 2026Counterfactual Explanations on Robust Perceptual Geodesicscited by 2
  12. 2026Provably Reliable Classifier Guidance via Cross-Entropy Controlcited by 1
3 more
  1. 2025Inverse Language Modeling towards Robust and Grounded LLMscited by 0
  2. 2025DeepDefense: Robust Learning via Layer-Wise Gradient-Feature Alignmentcited by 0
  3. 2026Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoderscited by 0