mlsanityData to 14 Oct 2026

Adversarial Examples Are Not Real Features

arXiv 2310.18936 ↗First posted 29 Oct 2023cs.LG cs.CVcited by 16

Not on the map. Why?

Abstract (arXiv)

The existence of adversarial examples has been a mystery for years and attracted much interest. A well-known theory by citetilyas2019adversarial explains adversarial vulnerability from a data perspective by showing that one can extract non-robust features from adversarial examples and these features alone are useful for classification. However, the explanation remains quite counter-intuitive since non-robust features are mostly noise features to humans. In this paper, we re-examine the theory from a larger context by incorporating multiple learning paradigms. Notably, we find that contrary to their good usefulness under supervised learning, non-robust features attain poor usefulness when transferred to other self-supervised learning paradigms, such as contrastive learning, masked image modeling, and diffusion models. It reveals that non-robust features are not really as useful as robust or natural features that enjoy good transferability between these paradigms. Meanwhile, for robustness, we also show that naturally trained encoders from robust features are largely non-robust under AutoAttack. Our cross-paradigm examination suggests that the non-robust features are not really useful but more like paradigm-wise shortcuts, and robust features alone might be insufficient to attain reliable model robustness. Code is available at urlhttps://github.com/PKU-ML/AdvNotRealFeatures.

Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Builds on 47 of its 53 references that are in the map. First posted on arXiv 29 Oct 2023.

Builds on

47 of 53 references.

References · 47

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  5. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
  6. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
  7. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  8. 2018Representation Learning with Contrastive Predictive Codingcited by 7,777
  9. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
  10. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
  11. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  12. 2016Densely Connected Convolutional Networkscited by 6,720
35 more
  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2014Going Deeper with Convolutionscited by 4,241
  4. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,375
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  7. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  8. 2018Robustness May Be at Odds with Accuracycited by 880
  9. 2018Adversarially Robust Generalization Requires More Datacited by 318
  10. 2021Provable Guarantees for Self-Supervised Deep Learning with Spectral Contrastive Losscited by 313
  11. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  12. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 153
  13. 2021On the Convergence and Robustness of Adversarial Trainingcited by 130
  14. 2023Denoising Diffusion Autoencoders are Unified Self-supervised Learnerscited by 130
  15. 2018Are adversarial examples inevitable?cited by 113
  16. 2022Chaos is a Ladder: A New Theoretical Understanding of Contrastive Learning via Augmentation Overlapcited by 105
  17. 2016Robustness of classifiers: from adversarial to random noisecited by 88
  18. 2022How Mask Matters: Towards Theoretical Understandings of Masked Autoencoderscited by 86
  19. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  20. 2020A Unified Approach to Interpreting and Boosting Adversarial Transferabilitycited by 71
  21. 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
  22. 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
  23. 2020Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspectivecited by 35
  24. 2023Towards a Unified Theoretical Understanding of Non-contrastive Learning via Rank Differential Mechanismcited by 33
  25. 2021Residual Relaxation for Multi-view Representation Learningcited by 30
  26. 2023On the Generalization of Multi-modal Contrastive Learningcited by 30
  27. 2023A Message Passing Perspective on Learning Dynamics of Contrastive Learningcited by 22
  28. 2023Rethinking the Effect of Data Augmentation in Adversarial Contrastive Learningcited by 20
  29. 2023Rethinking Weak Supervision in Helping Contrastive Learningcited by 18
  30. 2021A Unified Game-Theoretic Interpretation of Adversarial Robustnesscited by 17
  31. 2022Can we achieve robustness from data alone?cited by 16
  32. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  33. 2020Differentiable Data Augmentation with Korniacited by 4
  34. 2021Clustering Effect of (Linearized) Adversarial Robust Modelscited by 3
  35. 2019Learning to Disentangle Robust and Vulnerable Features for Adversarial Detectioncited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 1; 2024: 6; 2025: 6; 2026: 3.

16 papers.

Sort:

By area:

  1. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  2. 2024Exploring the Robustness of In-Context Learning with Noisy Labelscited by 14
  3. 2025Adversarial Attacks Leverage Interference Between Features in Superpositioncited by 8
  4. 2024PID: Prompt-Independent Data Protection Against Latent Diffusion Modelscited by 6
  5. 2024Benchmarking Robust Self-Supervised Learning Across Diverse Downstream Taskscited by 5
  6. 2025Unveiling and Mitigating Adversarial Vulnerabilities in Iterative Optimizerscited by 4
  7. 2024Improving Fast Adversarial Training via Self-Knowledge Guidancecited by 2
  8. 2024Feature compression is the root cause of adversarial fragility in neural network classifierscited by 1
  9. 2024Non-Robust Features are Not Always Useful in One-Class Classificationcited by 1
  10. 2025Adversarial Robustness of Discriminative Self-Supervised Learning in Visioncited by 1
  11. 2025A Versatile Framework for Designing Group-Sparse Adversarial Attackscited by 1
  12. 2026Rethinking Brain Decoding with CLIP: The Role of Adversarial Robustnesscited by 1
4 more
  1. 2025Identifying and Understanding Cross-Class Features in Adversarial Trainingcited by 0
  2. 2025Towards provable probabilistic safety for scalable embodied AI systemscited by 0
  3. 2026Adversarial Samples Are Not Created Equalcited by 0
  4. 2026Quality-Preserving Imperceptible Adversarial Attack on Skeleton-based Human Action Recognitioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Do Counterfactual Examples Complicate Adversarial Training?
  2. 2021Understanding Robustness in Teacher-Student Setting: A New Perspective
  3. 2022Towards Alternative Techniques for Improving Adversarial Robustness: Analysis of Adversarial Training at a Spectrum of Perturbations
  4. 2024Adversarial Robustification via Text-to-Image Diffusion Models
  5. 2022Holistic Approach to Measure Sample-level Adversarial Vulnerability and its Utility in Building Trustworthy Systems
  6. 2026Learning Robustness at Test-Time from a Non-Robust Teacher
  7. 2022Robustness of Unsupervised Representation Learning without Labels
  8. 2021Adversarial Examples Make Strong Poisons