mlsanityData to 14 Oct 2026

The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attacks

arXiv 2305.14188 ↗First posted 23 May 2023cs.LG cs.CR cs.CVcited by 15

Not on the map. Why?

Abstract (arXiv)

Many defenses against adversarial attacks (eg robust classifiers, randomization, or image purification) use countermeasures put to work only after the attack has been crafted. We adopt a different perspective to introduce A5 (Adversarial Augmentation Against Adversarial Attacks), a novel framework including the first certified preemptive defense against adversarial attacks. The main idea is to craft a defensive perturbation to guarantee that any attack (up to a given magnitude) towards the input in hand will fail. To this aim, we leverage existing automatic perturbation analysis tools for neural networks. We study the conditions to apply A5 effectively, analyze the importance of the robustness of the to-be-defended classifier, and inspect the appearance of the robustified images. We show effective on-the-fly defensive augmentation with a robustifier network that ignores the ground truth label, and demonstrate the benefits of robustifier and classifier co-training. In our tests, A5 consistently beats state of the art certified defenses on MNIST, CIFAR10, FashionMNIST and Tinyimagenet. We also show how to apply A5 to create certifiably robust physical objects. Our code at https://github.com/NVlabs/A5 allows experimenting on a wide range of scenarios beyond the man-in-the-middle attack tested here, including the case of physical attacks.

Key facts. Cited by 15 papers in the map (data through 14 Oct 2026). Builds on 29 of its 42 references that are in the map. First posted on arXiv 23 May 2023.

Builds on

29 of 42 references.

References · 29

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  4. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  6. 2019Adversarial Training for Free!cited by 643
  7. 2017One pixel attack for fooling deep neural networkscited by 582
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  9. 2022Diffusion Models for Adversarial Purificationcited by 476
  10. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
  11. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  12. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 328
17 more
  1. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  2. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 205
  3. 2020Bag of Tricks for Adversarial Trainingcited by 200
  4. 2020Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifierscited by 187
  5. 2021Adversarial purification with Score-based generative modelscited by 134
  6. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 94
  7. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 51
  8. 2021Online Adversarial Purification based on Self-Supervisioncited by 46
  9. 2020Unadversarial Examples: Designing Objects for Robust Visioncited by 45
  10. 2018Robust Audio Adversarial Example for a Physical Attackcited by 44
  11. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  12. 2017Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspectivecited by 38
  13. 2020Randomization matters. How to defend against strong adversarial attackscited by 37
  14. 2019Man-in-the-Middle Attacks against Machine Learning Classifiers via Malicious Generative Modelscited by 19
  15. 2020Encryption Inspired Adversarial Defense for Visual Classificationcited by 17
  16. 2021Study of Pre-processing Defenses against Adversarial Attacks on State-of-the-art Speaker Recognition Systemscited by 10
  17. 2021Preemptive Image Robustification for Protecting Users against Man-in-the-Middle Adversarial Attackscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 5; 2025: 7; 2026: 1.

15 papers.

Sort:

By area:

  1. 2025Analysing the Robustness of Vision-Language-Models to Common Corruptionscited by 16
  2. 2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 15
  3. 2023My Art My Choice: Adversarial Protection Against Unruly AIcited by 5
  4. 2025Diagnosing Corruption-Induced Reliability Failures in Vision-Language Modelscited by 4
  5. 2024L-WISE: Boosting Human Visual Category Learning Through Model-Based Image Selection and Enhancementcited by 2
  6. 2025Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognitioncited by 2
  7. 2025An Investigation of Visual Foundation Models Robustnesscited by 2
  8. 2023Is Certifying ℓp Robustness Still Worthwhile?cited by 1
  9. 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
  10. 2024Redesigning Traffic Signs to Mitigate Machine-Learning Patch Attackscited by 0
  11. 2024Improving Fast Adversarial Training Paradigm: An Example Taxonomy Perspectivecited by 0
  12. 2024Sustainable Self-evolution Adversarial Trainingcited by 0
3 more
  1. 2025Keep It Real: Challenges in Attacking Compression-Based Adversarial Purificationcited by 0
  2. 2025Trustworthy Semantic Communication for Vehicular Networks: Challenges and Solutionscited by 0
  3. 2026A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbationcited by 0