mlsanityData to 14 Oct 2026

Robust NAS under adversarial training: benchmark, theory, and beyond

arXiv 2403.13134 ↗First posted 19 Mar 2024cs.LG cs.AI stat.MLcited by 6

Not on the map. Why?

Abstract (arXiv)

Recent developments in neural architecture search (NAS) emphasize the significance of considering robust architectures against malicious data. However, there is a notable absence of benchmark evaluations and theoretical guarantees for searching these robust architectures, especially when adversarial training is considered. In this work, we aim to address these two challenges, making twofold contributions. First, we release a comprehensive data set that encompasses both clean accuracy and robust accuracy for a vast array of adversarially trained networks from the NAS-Bench-201 search space on image datasets. Then, leveraging the neural tangent kernel (NTK) tool from deep learning theory, we establish a generalization theory for searching architecture in terms of clean accuracy and robust accuracy under multi-objective adversarial training. We firmly believe that our benchmark and theoretical insights will significantly benefit the NAS community through reliable reproducibility, efficient assessment, and theoretical foundation, particularly in the pursuit of robust architectures.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Builds on 78 of its 86 references that are in the map. First posted on arXiv 19 Mar 2024.

Builds on

78 of 86 references.

References · 78

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  7. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  8. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,621
  9. 2020Fourier Features Let Networks Learn High Frequency Functions in Low Dimensional Domainscited by 2,200
  10. 2018DARTS: Differentiable Architecture Searchcited by 1,798
  11. 2016Adversarial examples in the physical worldcited by 1,769
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
38 more
  1. 2016Neural Architecture Search with Reinforcement Learningcited by 1,499
  2. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  4. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,101
  5. 2018Regularized Evolution for Image Classifier Architecture Searchcited by 909
  6. 2018A Convergence Theory for Deep Learning via Over-Parameterizationcited by 787
  7. 2019Wide Neural Networks of Any Depth Evolve as Linear Models Under Gradient Descentcited by 738
  8. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  9. 2018On Lazy Training in Differentiable Programmingcited by 675
  10. 2018Gradient Descent Provably Optimizes Over-parameterized Neural Networkscited by 659
  11. 2018Gradient Descent Finds Global Minima of Deep Neural Networkscited by 574
  12. 2020Overfitting in adversarially robust deep learningcited by 506
  13. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  14. 2020NAS-Bench-201: Extending the Scope of Reproducible Neural Architecture Searchcited by 416
  15. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 377
  16. 2017Large-Scale Evolution of Image Classifierscited by 348
  17. 2019NAS-Bench-101: Towards Reproducible Neural Architecture Searchcited by 344
  18. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  19. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  20. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 293
  21. 2016Designing Neural Network Architectures using Reinforcement Learningcited by 279
  22. 2019Random Search and Reproducibility for Neural Architecture Searchcited by 254
  23. 2020Neural Architecture Search without Trainingcited by 244
  24. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  25. 2019Generalization Bounds of Stochastic Gradient Descent for Wide and Deep Neural Networkscited by 222
  26. 2020Feature Learning in Infinite-Width Neural Networkscited by 190
  27. 2019Understanding and Robustifying Differentiable Architecture Searchcited by 178
  28. 2019On the Inductive Bias of Neural Tangent Kernelscited by 177
  29. 2019Towards Understanding the Spectral Bias of Deep Learningcited by 174
  30. 2021Neural Architecture Search on ImageNet in Four GPU Hours: A Theoretically Inspired Perspectivecited by 169
  31. 2019Graph Neural Tangent Kernel: Fusing Graph Neural Networks with Graph Kernelscited by 161
  32. 2023Neural Architecture Search: Insights from 1000 Paperscited by 139
  33. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 125
  34. 2021Rethinking Architecture Selection in Differentiable NAScited by 92
  35. 2019Harnessing the Power of Infinitely Wide Deep Nets on Small-data Taskscited by 87
  36. 2019When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attackscited by 87
  37. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 74
  38. 2020Surrogate NAS Benchmarks: Going Beyond the Limited Search Spaces of Tabular NAS Benchmarkscited by 67

50 most cited of 78 All 78 (JSON)

Built on by

Cited by year

Citing papers per year: 2025: 6.

6 papers.

  1. 2025On Accelerating Edge AI: Optimizing Resource-Constrained Environmentscited by 5
  2. 2025Architecture-Aware Minimization (A2M): How to Find Flat Minima in Neural Architecture Searchcited by 2
  3. 2025Diffusion-based Cumulative Adversarial Purification for Vision Language Modelscited by 2
  4. 2025Vision Transformer Neural Architecture Search for Out-of-Distribution Generalization: Benchmark and Insightscited by 0
  5. 2025ProARD: progressive adversarial robustness distillation: provide wide range of robust studentscited by 0
  6. 2025Neural Architecture Search with Mixed Bio-inspired Learning Rulescited by 0