mlsanityData to 7 Oct 2026

Adversarial Pruning: A Survey and Benchmark of Pruning Methods for Adversarial Robustness

arXiv 2409.01249 ↗First posted 2 Sep 2024cs.LG cs.CR cs.CVcited by 10

Not on the map. Why?

Abstract (arXiv)

Recent work has proposed neural network pruning techniques to reduce the size of a network while preserving robustness against adversarial examples, i.e., well-crafted inputs inducing a misclassification. These methods, which we refer to as adversarial pruning methods, involve complex and articulated designs, making it difficult to analyze the differences and establish a fair and accurate comparison. In this work, we overcome these issues by surveying current adversarial pruning methods and proposing a novel taxonomy to categorize them based on two main dimensions: the pipeline, defining when to prune; and the specifics, defining how to prune. We then highlight the limitations of current empirical analyses and propose a novel, fair evaluation benchmark to address them. We finally conduct an empirical re-evaluation of current adversarial pruning methods and discuss the results, highlighting the shared traits of top-performing adversarial pruning methods, as well as common issues. We welcome contributions in our publicly-available benchmark at https://github.com/pralab/AdversarialPruningBenchmark

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Builds on 56 of its 77 references that are in the map. First posted on arXiv 2 Sep 2024.

Builds on

56 of 77 references.

References · 56

  1. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  6. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,291
  9. 2018The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networkscited by 2,250
  10. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
38 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2016Pruning Filters for Efficient ConvNetscited by 1,129
  3. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  4. 2016Adversarial Machine Learning at Scalecited by 934
  5. 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 919
  6. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  7. 2017Channel Pruning for Accelerating Very Deep Neural Networkscited by 697
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2020What is the State of Neural Network Pruning?cited by 578
  11. 2019On Evaluating Adversarial Robustnesscited by 442
  12. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  13. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  14. 2019Sparse Networks from Scratch: Faster Training without Losing Performancecited by 210
  15. 2023A Survey on Deep Neural Network Pruning-Taxonomy, Comparison, Analysis, and Recommendationscited by 200
  16. 2017Data-Driven Sparse Structure Selection for Deep Neural Networkscited by 181
  17. 2021Chasing Sparsity in Vision Transformers: An End-to-End Explorationcited by 181
  18. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
  19. 2020Layer-adaptive sparsity for the Magnitude-based Pruningcited by 122
  20. 2019Adversarial Robustness vs Model Compression, or Both?cited by 98
  21. 2020Learnable Boundary Guided Adversarial Trainingcited by 93
  22. 2019Pruning by Explaining: A Novel Criterion for Deep Neural Network Pruningcited by 89
  23. 2018Sparse DNNs with Improved Adversarial Robustnesscited by 71
  24. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  25. 2019Accurate, reliable and fast robustness evaluationcited by 43
  26. 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
  27. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
  28. 2023Ten Lessons We Have Learned in the New "Sparseland": A Short Handbook for Sparse Neural Network Researcherscited by 25
  29. 2019Towards Compact and Robust Deep Neural Networkscited by 23
  30. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
  31. 2021On the Effect of Pruning on Adversarial Robustnesscited by 23
  32. 2022Masking Adversarial Damage: Finding Adversarial Saliency for Robust and Sparse Networkcited by 21
  33. 2020Achieving Adversarial Robustness via Sparsitycited by 14
  34. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  35. 2022Pruning Adversarially Robust Neural Networks without Adversarial Examplescited by 12
  36. 2019The Search for Sparse, Robust Neural Networkscited by 11
  37. 2020Towards Practical Lottery Ticket Hypothesis for Adversarial Trainingcited by 9
  38. 2019Robust Sparse Regularization: Simultaneously Optimizing Neural Network Robustness and Compactnesscited by 7

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 6; 2026: 3.

10 papers.

  1. 2025Diagnosing Corruption-Induced Reliability Failures in Vision-Language Modelscited by 3
  2. 2025On the Interaction of Compressibility and Adversarial Robustnesscited by 2
  3. 2025Two is Better than One: Efficient Ensemble Defense for Robust and Compact Modelscited by 1
  4. 2024Adaptive Pruning with Module Robustness Sensitivity: Balancing Compression and Robustnesscited by 0
  5. 2025Compression Aware Certified Trainingcited by 0
  6. 2025S2AP: Score-space Sharpness Minimization for Adversarial Pruningcited by 0
  7. 2025Hierarchical Sparse Plus Low Rank Compression of LLMcited by 0
  8. 2026GRAPE: Guided Parameter-Space Evolution for Compact Adversarial Robustnesscited by 0
  9. 2026Prescriptive SVD-Inspired Attention via Spectral Energy Retentioncited by 0
  10. 2026AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoderscited by 0