mlsanityData to 7 Oct 2026

AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses

arXiv 2503.01811 ↗First posted 3 Mar 2025cs.CR cs.AI cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

We introduce AutoAdvExBench, a benchmark to evaluate if large language models (LLMs) can autonomously exploit defenses to adversarial examples. Unlike existing security benchmarks that often serve as proxies for real-world tasks, bench directly measures LLMs' success on tasks regularly performed by machine learning security experts. This approach offers a significant advantage: if a LLM could solve the challenges presented in bench, it would immediately present practical utility for adversarial machine learning researchers. We then design a strong agent that is capable of breaking 75% of CTF-like ("homework exercise") adversarial example defenses. However, we show that this agent is only able to succeed on 13% of the real-world defenses in our benchmark, indicating the large gap between difficulty in attacking "real" code, and CTF-like code. In contrast, a stronger LLM that can attack 21% of real defenses only succeeds on 54% of CTF-like defenses. We make this benchmark available at https://github.com/ethz-spylab/AutoAdvExBench.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 71 of its 86 references that are in the map. First posted on arXiv 3 Mar 2025.

Builds on

71 of 86 references.

References · 71

  1. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
  7. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  8. 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,748
  11. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  12. 2019SuperGLUE: A Stickier Benchmark for General-Purpose Language Understanding Systemscited by 1,718
38 more
  1. 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,628
  2. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  4. 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
  5. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  6. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  9. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  10. 2017Countering Adversarial Images using Input Transformationscited by 517
  11. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  12. 2019On Evaluating Adversarial Robustnesscited by 442
  13. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  14. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  15. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  16. 2024FrontierMath: A Benchmark for Evaluating Advanced Mathematical Reasoning in AIcited by 227
  17. 2023An Overview of Catastrophic AI Riskscited by 214
  18. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  19. 2024RE-Bench: Evaluating frontier AI R&D capabilities of language model agents against human expertscited by 153
  20. 2021Adversarial purification with Score-based generative modelscited by 132
  21. 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agentscited by 129
  22. 2024SWE-Search: Enhancing Software Agents with Monte Carlo Tree Search and Iterative Refinementcited by 124
  23. 2024CORE-Bench: Fostering the Credibility of Published Research Through a Computational Reproducibility Agent Benchmarkcited by 115
  24. 2024LLM Agents can Autonomously Hack Websitescited by 108
  25. 2024ARC Prize 2024: Technical Reportcited by 103
  26. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  27. 2023PentestGPT: An LLM-empowered Automatic Penetration Testing Toolcited by 94
  28. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  29. 2024NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Securitycited by 90
  30. 2024CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Modelscited by 84
  31. 2023Getting pwn'd by AI: Penetration Testing with Large Language Modelscited by 82
  32. 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
  33. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  34. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  35. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  36. 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
  37. 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
  38. 2019A New Defense Against Adversarial Images: Turning a Weakness into a Strengthcited by 49

50 most cited of 71 All 71 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 10; 2026: 4.

14 papers.

Sort:

By area:

  1. 2025WASP: Benchmarking Web Agent Security Against Prompt Injection Attackscited by 140
  2. 2025CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scalecited by 71
  3. 2025Cyber-Zero: Training Cybersecurity Agents without Runtimecited by 22
  4. 2025Oyster-I: Beyond Refusal -- Constructive Safety Alignment for Responsible Language Modelscited by 19
  5. 2025Training Language Model Agents to Find Vulnerabilities with CTF-Dojocited by 15
  6. 2025Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testingcited by 14
  7. 2025Dynamic Risk Assessments for Offensive Cybersecurity Agentscited by 7
  8. 2025LLMs unlock new paths to monetizing exploitscited by 5
  9. 2025HackWorld: Evaluating Computer-Use Agents on Exploiting Web Application Vulnerabilitiescited by 2
  10. 2025Breaking Guardrails, Facing Walls: Insights on Adversarial AI for Defenders & Researcherscited by 0
  11. 2026Automated Membership Inference Attacks (AutoMIA): Discovering MIA Signal Computations using LLM Agentscited by 0
  12. 2026Auto-ART: Structured Literature Synthesis and Automated Adversarial Robustness Testingcited by 0
2 more
  1. 2026Engineering Trustworthy Agentic AI for Critical Systemscited by 0
  2. 2026CyberClear: A Benchmark for LLM Agent Systems on APT Attack Chain Provenancecited by 0