mlsanityData to 7 Oct 2026

How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses

arXiv 2305.10862 ↗First posted 18 May 2023cs.CVcited by 65

Not on the map. Why?

Abstract (arXiv)

Deep Learning is currently used to perform multiple tasks, such as object recognition, face recognition, and natural language processing. However, Deep Neural Networks (DNNs) are vulnerable to perturbations that alter the network prediction (adversarial examples), raising concerns regarding its usage in critical areas, such as self-driving vehicles, malware detection, and healthcare. This paper compiles the most recent adversarial attacks, grouped by the attacker capacity, and modern defenses clustered by protection strategies. We also present the new advances regarding Vision Transformers, summarize the datasets and metrics used in the context of adversarial settings, and compare the state-of-the-art results under different attacks, finishing with the identification of open issues.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). Builds on 153 of its 248 references that are in the map. First posted on arXiv 18 May 2023.

Builds on

153 of 248 references.

References · 153

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,339
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  10. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  12. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
38 more
  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  3. 2016Wide Residual Networkscited by 3,057
  4. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  7. 2021Pyramid Vision Transformer: A Versatile Backbone for Dense Prediction without Convolutionscited by 1,960
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  10. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  12. 2019Natural Adversarial Examplescited by 1,401
  13. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  14. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  15. 2021Tokens-to-Token ViT: Training Vision Transformers from Scratch on ImageNetcited by 1,096
  16. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  17. 2017Sigmoid-Weighted Linear Units for Neural Network Function Approximation in Reinforcement Learningcited by 935
  18. 2016Adversarial Machine Learning at Scalecited by 934
  19. 2018Robustness May Be at Odds with Accuracycited by 873
  20. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  21. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  22. 2016Universal adversarial perturbationscited by 774
  23. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  24. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  25. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  26. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  27. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  28. 2019Adversarial Training for Free!cited by 638
  29. 2017Wasserstein GANcited by 635
  30. 2020Learning Continuous Image Representation with Local Implicit Image Functioncited by 550
  31. 2020Overfitting in adversarially robust deep learningcited by 504
  32. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  33. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  34. 2021ConViT: Improving Vision Transformers with Soft Convolutional Inductive Biasescited by 484
  35. 2022Diffusion Models for Adversarial Purificationcited by 469
  36. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  37. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  38. 2021Intriguing Properties of Vision Transformerscited by 446

50 most cited of 153 All 153 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 19; 2025: 30; 2026: 14.

65 papers.

Sort:

By area:

  1. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 113
  2. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
  3. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 36
  4. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  5. 2024A Survey on Diffusion Models for Recommender Systemscited by 20
  6. 2024SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agentscited by 19
  7. 2025One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIPcited by 15
  8. 2025MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agentscited by 12
  9. 2024OSLO: One-Shot Label-Only Membership Inference Attackscited by 11
  10. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  11. 2024Machine Learning Robustness: A Primercited by 8
  12. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
38 more
  1. 2025Adversarial Attacks Leverage Interference Between Features in Superpositioncited by 7
  2. 2024Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Surveycited by 6
  3. 2024Hijacking Vision-and-Language Navigation Agents with Adversarial Environmental Attackscited by 5
  4. 2025Unified Prompt Attack Against Text-to-Image Generation Modelscited by 5
  5. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  6. 2024Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detectioncited by 4
  7. 2025Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?cited by 4
  8. 2024Classification under strategic adversary manipulation using pessimistic bilevel optimisationcited by 2
  9. 2024Derivative-Free Diffusion Manifold-Constrained Gradient for Unified XAIcited by 2
  10. 2025Towards Robust Stability Prediction in Smart Grids: GAN-based Approach under Data Constraints and Adversarial Challengescited by 2
  11. 20251-Lipschitz Network Initialization for Certifiably Robust Classification Applications: A Decay Problemcited by 2
  12. 2025Stop Walking in Circles! Bailing Out Early in Projected Gradient Descentcited by 2
  13. 2025A Comprehensive Survey on Physical Risk Control in the Era of Foundation Model-enabled Roboticscited by 2
  14. 2025Are Time-Series Foundation Models Deployment-Ready? A Systematic Study of Adversarial Robustness Across Domainscited by 2
  15. 2025Bridging the Task Gap: Multi-Task Adversarial Transferability in CLIP and Its Derivativescited by 2
  16. 2023Rapid Plug-in Defenderscited by 1
  17. 2024Harmonic Machine Learning Models are Robustcited by 1
  18. 2024Resilience in Knowledge Graph Embeddingscited by 1
  19. 2024Brain-like emergent properties in deep networks: impact of network architecture, datasets and trainingcited by 1
  20. 2024Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attackscited by 1
  21. 2025Topological Signatures of Adversaries in Multimodal Alignmentscited by 1
  22. 2025Democratic Training Against Universal Adversarial Perturbationscited by 1
  23. 2025Cross-Model Transferability of Adversarial Patches in Real-time Segmentation for Autonomous Drivingcited by 1
  24. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  25. 2025ReLATE: Resilient Learner Selection for Multivariate Time-Series Classification Against Adversarial Attackscited by 1
  26. 2025Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domaincited by 1
  27. 2025Active Adversarial Noise Suppression for Image Forgery Localizationcited by 1
  28. 2025Counterfactual Visual Explanation via Causally-Guided Adversarial Steeringcited by 1
  29. 2025Forecasting Fails: Unveiling Evasion Attacks in Weather Prediction Modelscited by 1
  30. 2025Bridging Efficiency and Safety: Formal Verification of Neural Networks with Early Exitscited by 1
  31. 2026Shapes are not enough: CONSERVAttack and its use for finding vulnerabilities and uncertainties in machine learning applicationscited by 1
  32. 2026INTARG: Informed Real-Time Adversarial Attack Generation for Time-Series Regressioncited by 1
  33. 2026MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attackscited by 1
  34. 2024Robust Network Learning via Inverse Scale Variational Sparsificationcited by 0
  35. 2025ProARD: progressive adversarial robustness distillation: provide wide range of robust studentscited by 0
  36. 2025Learning from Peers: Collaborative Ensemble Adversarial Trainingcited by 0
  37. 2025Breaking SafetyCore: Exploring the Risks of On-Device AI Deploymentcited by 0
  38. 2025Countering adversarial evasion in regression analysiscited by 0

50 most cited of 65 All 65 (JSON)