mlsanityData to 7 Oct 2026

Solving adversarial examples requires solving exponential misalignment

arXiv 2603.03507 ↗First posted 3 Mar 2026cs.LG cond-mat.dis-nn q-bio.NCcited by 1

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks - input perturbations imperceptible to humans that fool neural networks - remain both a persistent failure mode in machine learning, and a phenomenon with mysterious origins. To shed light, we define and analyze a network's perceptual manifold (PM) for a class concept as the space of all inputs confidently assigned to that class by the network. We find, strikingly, that the dimensionalities of neural network PMs are orders of magnitude higher than those of natural human concepts. Since volume typically grows exponentially with dimension, this suggests exponential misalignment between machines and humans, with exponentially many inputs confidently assigned to concepts by machines but not humans. Furthermore, this provides a natural geometric hypothesis for the origin of adversarial examples: because a network's PM fills such a large region of input space, any input will be very close to any class concept's PM. Our hypothesis thus suggests that adversarial robustness cannot be attained without dimensional alignment of machine and human PMs, and therefore makes strong predictions: both robust accuracy and distance to any PM should be negatively correlated with the PM dimension. We confirmed these predictions across 18 different networks of varying robust accuracy. Crucially, we find even the most robust networks are still exponentially misaligned, and only the few PMs whose dimensionality approaches that of human concepts exhibit alignment to human perception. Our results connect the fields of alignment and adversarial examples, and suggest the curse of high dimensionality of machine PMs is a major impediment to adversarial robustness.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 39 of its 51 references that are in the map. First posted on arXiv 3 Mar 2026.

Builds on

39 of 51 references.

References · 39

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  9. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  10. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  11. 2022Diffusion Models for Adversarial Purificationcited by 469
  12. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
27 more
  1. 2018Adversarially Robust Generalization Requires More Datacited by 318
  2. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  3. 2018Estimating the intrinsic dimension of datasets by a minimal neighborhood informationcited by 246
  4. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  5. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  6. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  7. 2018Disentangling Adversarial Robustness and Generalizationcited by 171
  8. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  9. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  10. 2018Are adversarial examples inevitable?cited by 113
  11. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  12. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  13. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  14. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
  15. 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
  16. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  17. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  18. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  19. 2018The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measurecited by 44
  20. 2018On the Geometry of Adversarial Examplescited by 43
  21. 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studiescited by 38
  22. 2022Revisiting Residual Networks for Adversarial Robustness: An Architectural Perspectivecited by 28
  23. 2022Scaling Adversarial Training to Large Perturbation Boundscited by 20
  24. 2018Neural Networks Should Be Wide Enough to Learn Disconnected Decision Regionscited by 17
  25. 2023MIMIR: Masked Image Modeling for Mutual Information-based Adversarial Robustnesscited by 12
  26. 2024Characterizing Model Robustness via Natural Input Gradientscited by 6
  27. 2024Fooling LLM graders into giving better grades through neural activity guided adversarial promptingcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Geometric Configurations of Perturbed Jailbreak Promptscited by 0