mlsanityData to 13 Oct 2026

Defenses in Adversarial Machine Learning: A Survey

arXiv 2312.08890 ↗First posted 13 Dec 2023cs.CV cs.CR cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

Adversarial phenomenon has been widely observed in machine learning (ML) systems, especially in those using deep neural networks, describing that ML systems may produce inconsistent and incomprehensible predictions with humans at some particular cases. This phenomenon poses a serious security threat to the practical application of ML systems, and several advanced attack paradigms have been developed to explore it, mainly including backdoor attacks, weight attacks, and adversarial examples. For each individual attack paradigm, various defense paradigms have been developed to improve the model robustness against the corresponding attack paradigm. However, due to the independence and diversity of these defense paradigms, it is difficult to examine the overall robustness of an ML system against different kinds of attacks.This survey aims to build a systematic review of all existing defense paradigms from a unified perspective. Specifically, from the life-cycle perspective, we factorize a complete machine learning system into five stages, including pre-training, training, post-training, deployment, and inference stages, respectively. Then, we present a clear taxonomy to categorize and review representative defense methods at each individual stage. The unified perspective and presented taxonomies not only facilitate the analysis of the mechanism of each defense paradigm but also help us to understand connections and differences among different defense paradigms, which may inspire future research to develop more advanced, comprehensive defenses.

Key facts. Cited by 14 papers in the map (data through 13 Oct 2026). Builds on 192 of its 234 references that are in the map. First posted on arXiv 13 Dec 2023.

Builds on

192 of 234 references.

References · 192

  1. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,009
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
  3. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,511
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,099
  5. 2017Multimodal Machine Learning: A Survey and Taxonomycited by 1,009
  6. 2017Ensemble Adversarial Training: Attacks and Defensescited by 839
  7. 2018How To Backdoor Federated Learningcited by 764
  8. 2019Adversarial Training for Free!cited by 641
  9. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 579
  10. 2017Countering Adversarial Images using Input Transformationscited by 519
  11. 2020Overfitting in adversarially robust deep learningcited by 505
  12. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
38 more
  1. 2018Spectral Signatures in Backdoor Attackscited by 481
  2. 2022Diffusion Models for Adversarial Purificationcited by 472
  3. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 456
  4. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 451
  5. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  6. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  7. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  8. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 323
  9. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 308
  10. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 281
  11. 2020BERT Loses Patience: Fast and Robust Inference with Early Exitcited by 270
  12. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  13. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 262
  14. 2019Can You Really Backdoor Federated Learning?cited by 254
  15. 2017Detecting Adversarial Samples from Artifactscited by 244
  16. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  17. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  18. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  19. 2021Improving Robustness using Generated Datacited by 234
  20. 2017On Detecting Adversarial Perturbationscited by 232
  21. 2018Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learningcited by 204
  22. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 198
  23. 2021Are Transformers More Robust Than CNNs?cited by 187
  24. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
  25. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  26. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  27. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  28. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 178
  29. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  30. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 164
  31. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 164
  32. 2019Are Labels Required for Improving Adversarial Robustness?cited by 163
  33. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  34. 2018Mitigating Sybils in Federated Learning Poisoningcited by 160
  35. 2022Backdoor Defense via Decoupling the Training Processcited by 152
  36. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 151
  37. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 145
  38. 2021Adversarial purification with Score-based generative modelscited by 133

50 most cited of 192 All 192 (JSON)

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2024: 8; 2025: 4; 2026: 2.

14 papers.

Sort:

By area:

  1. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  2. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
  3. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  4. 2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 11
  5. 2024Video Watermarking: Safeguarding Your Video from (Unauthorized) Annotations by Video-based LLMscited by 7
  6. 2025Protecting Your Video Content: Disrupting Automated Video-based LLM Annotationscited by 5
  7. 2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2
  8. 2024Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimizationcited by 2
  9. 2025Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Featurescited by 1
  10. 2026Fortifying Time Series: DTW-Certified Robust Anomaly Detectioncited by 1
  11. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
  12. 2025Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognitioncited by 0
2 more
  1. 2025Proactive Disentangled Modeling of Trigger-Object Pairings for Backdoor Defensecited by 0
  2. 2026Adversarial Robustness of Deep Learning-Based Thyroid Nodule Segmentation in Ultrasoundcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024A Novel Approach to Guard from Adversarial Attacks using Stable Diffusion
  2. 2024Deep Learning Model Security: Threats and Defenses
  3. 2024A Review of the Duality of Adversarial Learning in Network Intrusion: Attacks and Countermeasures ↗
  4. 2022Threat Model-Agnostic Adversarial Defense using Diffusion Models
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models
  6. 2026Adversarial Defense in Vision-Language Models: An Overview
  7. 2025Early Approaches to Adversarial Fine-Tuning for Prompt Injection Defense: A 2022 Study of GPT-3 and Contemporary Models
  8. 2025Amplifying Machine Learning Attacks Through Strategic Compositions