mlsanityData to 7 Oct 2026

MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsification

arXiv 2406.05927 ↗First posted 9 Jun 2024cs.CV cs.CR cs.LGcited by 20

Not on the map. Why?

Abstract (arXiv)

We present a simple yet effective method to improve the robustness of both Convolutional and attention-based Neural Networks against adversarial examples by post-processing an adversarially trained model. Our technique, MeanSparse, cascades the activation functions of a trained model with novel operators that sparsify mean-centered feature vectors. This is equivalent to reducing feature variations around the mean, and we show that such reduced variations merely affect the model's utility, yet they strongly attenuate the adversarial perturbations and decrease the attacker's success rate. Our experiments show that, when applied to the top models in the RobustBench leaderboard, MeanSparse achieves a new robustness record of 75.28% (from 73.71%), 44.78% (from 42.67%) and 62.12% (from 59.56%) on CIFAR-10, CIFAR-100 and ImageNet, respectively, in terms of AutoAttack accuracy. Code is available at https://github.com/SPIN-UMass/MeanSparse

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Builds on 37 of its 55 references that are in the map. First posted on arXiv 9 Jun 2024.

Builds on

37 of 55 references.

References · 37

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  5. 2016Gaussian Error Linear Units (GELUs)cited by 3,431
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  9. 2015Fast and Accurate Deep Network Learning by Exponential Linear Units (ELUs)cited by 1,061
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  11. 2017Sigmoid-Weighted Linear Units for Neural Network Function Approximation in Reinforcement Learningcited by 935
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
25 more
  1. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  3. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  4. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  5. 2021Improving Robustness using Generated Datacited by 233
  6. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  7. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  8. 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
  9. 2018Curriculum Adversarial Trainingcited by 89
  10. 2020Smooth Adversarial Trainingcited by 89
  11. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  12. 2020CAT: Customized Adversarial Training for Improved Robustnesscited by 61
  13. 2017Efficient Defenses Against Adversarial Attackscited by 53
  14. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  15. 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studiescited by 38
  16. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  17. 2021Parameterizing Activation Functions for Adversarial Robustnesscited by 22
  18. 2021Reproducing Activation Function for Deep Learningcited by 19
  19. 2020SPLASH: Learnable Activation Functions for Improving Accuracy and Adversarial Robustnesscited by 18
  20. 2018Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functionscited by 17
  21. 2018Adversarial Defense via Data Dependent Activation Function and Total Variation Minimizationcited by 9
  22. 2020Using Single-Step Adversarial Training to Defend Iterative Adversarial Examplescited by 9
  23. 2016Suppressing the Unusual: towards Robust CNNs using Symmetric Activation Functionscited by 4
  24. 2022SignReLU neural network and its approximation abilitycited by 4
  25. 2020Regularizers for Single-step Adversarial Trainingcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 11; 2026: 8.

20 papers.

Sort:

By area:

  1. 2025One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIPcited by 15
  2. 2024Instant Adversarial Purification with Adversarial Consistency Distillationcited by 14
  3. 2025CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classificationcited by 12
  4. 2025Monitoring Robustness and Individual Fairnesscited by 3
  5. 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purificationcited by 1
  6. 2025MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purificationcited by 1
  7. 2025A Versatile Framework for Designing Group-Sparse Adversarial Attackscited by 1
  8. 2025Diffusion Models are Robust Pretrainerscited by 1
  9. 2025Secure Diagnostics: Adversarial Robustness Meets Clinical Interpretabilitycited by 0
  10. 2025Keep It Real: Challenges in Attacking Compression-Based Adversarial Purificationcited by 0
  11. 2025Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networkscited by 0
  12. 2025Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attackscited by 0
8 more
  1. 2026Enhancing Adversarial Robustness with Signed Distance Fields for Harmonizing Geometric Invariance and Texturecited by 0
  2. 2026Fast Preemptive Robustification: High-Frequency Response Anti-Aligns Shared Vulnerabilitycited by 0
  3. 2026Compression as an Adversarial Amplifier Through Decision Space Reductioncited by 0
  4. 2026Sensitivity as a Double-Edged Sword: A Trade-off Between Discriminability and Adversarial Robustnesscited by 0
  5. 2026A combination of noise and bilateral filters achieve supralinear and scalable adversarial robustness in CNNscited by 0
  6. 2026VanillaBench: The Hidden Accuracy Cost of Adversarial Robustnesscited by 0
  7. 2026Neither Adversarial Training Nor Purification: Emergent Adversarial Robustness from Oscillatory Predictive Learningcited by 0
  8. 2026Frame the adversary: a structure-aware attack methodologycited by 0