# R-LPIPS: An Adversarially Robust Perceptual Similarity Metric

arXiv: https://arxiv.org/abs/2307.15157 · HTML: https://mlsanity.com/paper/2307.15157/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 26 references that are in the map.
- First posted on arXiv 27 Jul 2023.

## Builds on (most cited first, 16 of 16)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples](https://mlsanity.com/paper/1802.00420/) (2018)
- [Perceptual Adversarial Robustness: Defense Against Unseen Threat Models](https://mlsanity.com/paper/2006.12655/) (2020)
- [A Dynamical System Perspective for Lipschitz Neural Networks](https://mlsanity.com/paper/2110.12690/) (2021)
- [A Unified Algebraic Perspective on Lipschitz Neural Networks](https://mlsanity.com/paper/2303.03169/) (2023)
- [Mind the box: l1-APGD for sparse adversarial attacks on image classifiers](https://mlsanity.com/paper/2103.01208/) (2021)
- [E-LPIPS: Robust Perceptual Image Similarity via Random Transformation Ensembles](https://mlsanity.com/paper/1906.03973/) (2019)
- [Theoretical evidence for adversarial robustness through randomization](https://mlsanity.com/paper/1902.01148/) (2019)
- [Advocating for Multiple Defense Strategies against Adversarial Examples](https://mlsanity.com/paper/2012.02632/) (2020)

## Built on by (most cited first, 28 of 28)

- [Adversarial Illusions in Multi-Modal Embeddings](https://mlsanity.com/paper/2308.11804/) (2023)
- [Organic or Diffused: Can We Distinguish Human Art from AI-generated Images?](https://mlsanity.com/paper/2402.03214/) (2024)
- [LipSim: A Provably Robust Perceptual Similarity Metric](https://mlsanity.com/paper/2310.18274/) (2023)
- [Adversarially Robust CLIP Models Can Induce Better (Robust) Perceptual Metrics](https://mlsanity.com/paper/2502.11725/) (2025)
- [EMMA: Efficient Visual Alignment in Multi-Modal LLMs](https://mlsanity.com/paper/2410.02080/) (2024)
- [Augmenting Perceptual Super-Resolution via Image Quality Predictors](https://mlsanity.com/paper/2504.18524/) (2025)
- [Foundation Models Boost Low-Level Perceptual Similarity Metrics](https://mlsanity.com/paper/2409.07650/) (2024)
- [Hallucination Score: Towards Mitigating Hallucinations in Generative Image Super-Resolution](https://mlsanity.com/paper/2507.14367/) (2025)
- [Adversarial purification for no-reference image-quality metrics: applicability study and new methods](https://mlsanity.com/paper/2404.06957/) (2024)
- [DeepShade: Enable Shade Simulation by Text-conditioned Image Generation](https://mlsanity.com/paper/2507.12103/) (2025)
- [OAPT: Offset-Aware Partition Transformer for Double JPEG Artifacts Removal](https://mlsanity.com/paper/2408.11480/) (2024)
- [Quality Prediction of AI Generated Images and Videos: Emerging Trends and Opportunities](https://mlsanity.com/paper/2410.08534/) (2024)
- [Towards Unified Benchmark and Models for Multi-Modal Perceptual Metrics](https://mlsanity.com/paper/2412.10594/) (2024)
- [Adapting to Evolving Adversaries with Regularized Continual Robust Training](https://mlsanity.com/paper/2502.04248/) (2025)
- [Robustness in Both Domains: CLIP Needs a Robust Text Encoder](https://mlsanity.com/paper/2506.03355/) (2025)
- [Counterfactual Explanations on Robust Perceptual Geodesics](https://mlsanity.com/paper/2601.18678/) (2026)
- [Position: Towards Resilience Against Adversarial Examples](https://mlsanity.com/paper/2405.01349/) (2024)
- [BiRQA: Bidirectional Robust Quality Assessment for Images](https://mlsanity.com/paper/2602.20351/) (2026)
- [Stochastic BIQA: Median Randomized Smoothing for Certified Blind Image Quality Assessment](https://mlsanity.com/paper/2411.12575/) (2024)
- [Disentangling Safe and Unsafe Corruptions via Anisotropy and Locality](https://mlsanity.com/paper/2501.18098/) (2025)
- [Real-Time Cooked Food Image Synthesis and Visual Cooking Progress Monitoring on Edge Devices](https://mlsanity.com/paper/2511.16965/) (2025)
- [Structured Uncertainty Similarity Score (SUSS): Learning a Probabilistic, Interpretable, Perceptual Metric Between Images](https://mlsanity.com/paper/2512.03701/) (2025)
- [Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoors](https://mlsanity.com/paper/2603.09772/) (2026)
- [The Silent Brush: Evaluating Artistic Style Leakage in AI Art Generation](https://mlsanity.com/paper/2605.17500/) (2026)
- [ShadeBench: A Benchmark Dataset for Building Shade Simulation in Sustainable Society](https://mlsanity.com/paper/2605.20510/) (2026)
- [Injecting Image Guidance into Text-Conditioned Diffusion Models at Inference](https://mlsanity.com/paper/2605.25191/) (2026)
- [PlantShade: Predicting Plant Shadows for Lighting-Aware Robotic Agricultural Operation](https://mlsanity.com/paper/2609.21059/) (2026)
- [Pareto-Improving Adversarial Attacks with Primal-Dual Regularization](https://mlsanity.com/paper/2610.04652/) (2026)

## Abstract (arXiv)

Similarity metrics have played a significant role in computer vision to capture the underlying semantics of images. In recent years, advanced similarity metrics, such as the Learned Perceptual Image Patch Similarity (LPIPS), have emerged. These metrics leverage deep features extracted from trained neural networks and have demonstrated a remarkable ability to closely align with human perception when evaluating relative image similarity. However, it is now well-known that neural networks are susceptible to adversarial examples, i.e., small perturbations invisible to humans crafted to deliberately mislead the model. Consequently, the LPIPS metric is also sensitive to such adversarial examples. This susceptibility introduces significant security concerns, especially considering the widespread adoption of LPIPS in large-scale applications. In this paper, we propose the Robust Learned Perceptual Image Patch Similarity (R-LPIPS) metric, a new metric that leverages adversarially trained deep features. Through a comprehensive set of experiments, we demonstrate the superiority of R-LPIPS compared to the classical LPIPS metric. The code is available at https://github.com/SaraGhazanfari/R-LPIPS.