mlsanityData to 7 Oct 2026

Revisiting Adversarial Training at Scale

arXiv 2401.04727 ↗First posted 9 Jan 2024cs.CVcited by 33

Not on the map. Why?

Abstract (arXiv)

The machine learning community has witnessed a drastic change in the training pipeline, pivoted by those ''foundation models'' with unprecedented scales. However, the field of adversarial training is lagging behind, predominantly centered around small model sizes like ResNet-50, and tiny and low-resolution datasets like CIFAR-10. To bridge this transformation gap, this paper provides a modern re-examination with adversarial training, investigating its potential benefits when applied at scale. Additionally, we introduce an efficient and effective training strategy to enable adversarial training with giant models and web-scale data at an affordable computing cost. We denote this newly introduced framework as AdvXL. Empirical results demonstrate that AdvXL establishes new state-of-the-art robust accuracy records under AutoAttack on ImageNet-1K. For example, by training on DataComp-1B dataset, our AdvXL empowers a vanilla ViT-g model to substantially surpass the previous records of l∞-, l2-, and l1-robust accuracy by margins of 11.4%, 14.2% and 12.9%, respectively. This achievement posits AdvXL as a pioneering approach, charting a new trajectory for the efficient training of robust visual representations at significantly larger scales. Our code is available at https://github.com/UCSC-VLAA/AdvXL.

Key facts. Cited by 33 papers in the map (data through 7 Oct 2026). Builds on 58 of its 66 references that are in the map. First posted on arXiv 9 Jan 2024.

Builds on

58 of 66 references.

References · 58

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  4. 2020Language Models are Few-Shot Learnerscited by 32,199
  5. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  6. 2023GPT-4 Technical Reportcited by 18,132
  7. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  8. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  9. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  10. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,339
  11. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  12. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
38 more
  1. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  4. 2022A ConvNet for the 2020scited by 3,545
  5. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  6. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
  7. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,261
  8. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,544
  9. 2021Swin Transformer V2: Scaling Up Capacity and Resolutioncited by 1,215
  10. 2021Scaling Vision Transformerscited by 993
  11. 2016Deep Networks with Stochastic Depthcited by 973
  12. 2021Open-vocabulary Object Detection via Vision and Language Knowledge Distillationcited by 903
  13. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  14. 2022Language-driven Semantic Segmentationcited by 711
  15. 2023Scaling Vision Transformers to 22 Billion Parameterscited by 690
  16. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  17. 2022EVA: Exploring the Limits of Masked Visual Representation Learning at Scalecited by 685
  18. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  19. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  20. 2019Adversarial Training for Free!cited by 638
  21. 2023DataComp: In search of the next generation of multimodal datasetscited by 635
  22. 2022Detecting Twenty-thousand Classes using Image-level Supervisioncited by 613
  23. 2021RegionCLIP: Region-based Language-Image Pretrainingcited by 612
  24. 2021DenseCLIP: Language-Guided Dense Prediction with Context-Aware Promptingcited by 530
  25. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  26. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  27. 2022Scaling Language-Image Pre-training via Maskingcited by 317
  28. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  29. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  30. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  31. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  32. 2020Bag of Tricks for Adversarial Trainingcited by 199
  33. 2021Are Transformers More Robust Than CNNs?cited by 187
  34. 2017Generative Adversarial Perturbationscited by 153
  35. 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 152
  36. 2020Smooth Adversarial Trainingcited by 89
  37. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  38. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79

50 most cited of 58 All 58 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 5; 2025: 16; 2026: 12.

33 papers.

Sort:

By area:

  1. 2025Trading Inference-Time Compute for Adversarial Robustnesscited by 60
  2. 2024Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress?cited by 56
  3. 2024TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Modelscited by 22
  4. 2025Double Visual Defense: Adversarial Pre-training and Instruction Tuning for Improving Vision-Language Model Robustnesscited by 10
  5. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Modelscited by 10
  6. 2025Robust-LLaVA: On the Effectiveness of Large-Scale Robust Image Encoders for Multi-modal Large Language Modelscited by 9
  7. 2025Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videoscited by 9
  8. 2025AdPO: Enhancing the Adversarial Robustness of Large Vision-Language Models with Preference Optimizationcited by 8
  9. 2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 7
  10. 2025VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Modelscited by 7
  11. 2024Adversarial Training: A Surveycited by 6
  12. 2024Adversarial Prompt Distillation for Vision-Language Modelscited by 6
21 more
  1. 2024SoK: Blockchain-Based Decentralized AI (DeAI)cited by 6
  2. 2025ATP: Adaptive Threshold Pruning for Efficient Data Encoding in Quantum Neural Networkscited by 5
  3. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  4. 2025Robustness Feature Adapter for Efficient Adversarial Trainingcited by 2
  5. 2026Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIPcited by 2
  6. 2025Boosting Adversarial Transferability with Spatial Adversarial Alignmentcited by 1
  7. 2025Weakly Supervised Contrastive Adversarial Training for Learning Robust Features from Semi-supervised Datacited by 1
  8. 2025A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detectioncited by 1
  9. 2025A Guide to Robust Generalization: The Impact of Architecture, Pre-training, and Optimization Strategycited by 1
  10. 2026Mitigating Error Amplification in Fast Adversarial Trainingcited by 1
  11. 2025DeepDefense: Robust Learning via Layer-Wise Gradient-Feature Alignmentcited by 0
  12. 2026Feature-Space Smoothing: Certified Robustness of Deep Representationscited by 0
  13. 2026What Makes VLMs Robust? Towards Reconciling Robustness and Accuracy in Vision-Language Modelscited by 0
  14. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0
  15. 2026Laplace-Bridged Randomized Smoothing for Fast Certified Robustnesscited by 0
  16. 2026TAME: Test-Time Adversarial Prompt Tuning via Mixture-of-Experts for Vision-Language Modelscited by 0
  17. 2026Investigating Adversarial Robustness of Multi-modal Large Language Modelscited by 0
  18. 2026Adaptive Causal Alignment for High-Confidence Adversarial Trainingcited by 0
  19. 2026RoME: Robust Mixture of Low-Rank Experts against Multiple Adversarial Perturbationscited by 0
  20. 2026LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detectioncited by 0
  21. 2026GeoDetect: Geometric Adversarial Detection for VLPscited by 0