{"url":"/task/adversarial-defense","name":"Adversarial Defense","slug":"adversarial-defense","description_markdown":"Competitions with currently unpublished results:\r\n\r\n- [TrojAI](https://pages.nist.gov/trojai/)","categories":[{"name":"Adversarial","url":"/area/adversarial"}],"source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","slug_source":"archive_url"},"counts":{"papers_tagged":403,"papers_with_code":216,"benchmarks":10,"benchmark_tables_in_archive":10,"benchmark_tables_shown":10,"benchmark_tables_withheld_as_spam":0,"benchmark_definition":"a leaderboard table with at least one row; benchmark_tables_shown also counts the zero-row tables; benchmark_tables_in_archive adds the tables withheld as spam","datasets":5,"subtasks":2,"parent_tasks":0},"benchmarks":[{"leaderboard":"/sota/adversarial-defense-on-cifar-10","slug":"adversarial-defense-on-cifar-10","dataset":"CIFAR-10","dataset_url":"/dataset/cifar-10","rows_in_archive":8,"metrics":["Accuracy","Attack: AutoAttack","Robust Accuracy"],"first_row_in_archive_order":{"model":"WRN-28-10","paper_title":"Language Guided Adversarial Purification","paper_url":"/paper/language-guided-adversarial-purification","paper_date":"2023-09-19","arxiv_id":"2309.10348","code_links":[{"title":"Visual-Conception-Group/LGAP","url":"https://github.com/Visual-Conception-Group/LGAP"}],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-imagenet-non-targeted","slug":"adversarial-defense-on-imagenet-non-targeted","dataset":"ImageNet (non-targeted PGD, max perturbation=4)","dataset_url":null,"rows_in_archive":5,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"SAT-EfficientNet-L1","paper_title":"Smooth Adversarial Training","paper_url":"/paper/smooth-adversarial-training","paper_date":"2020-06-25","arxiv_id":"2006.14536","code_links":[{"title":"cihangxie/SmoothAdversarialTraining","url":"https://github.com/cihangxie/SmoothAdversarialTraining"}],"syntology":{"n":14,"n_ran":1,"n_unverified":13,"n_pointer_only":0}}},{"leaderboard":"/sota/adversarial-defense-on-cifar-100","slug":"adversarial-defense-on-cifar-100","dataset":"CIFAR-100","dataset_url":"/dataset/cifar-100","rows_in_archive":3,"metrics":["autoattack"],"first_row_in_archive_order":{"model":"wideresnet-34-20","paper_title":"Learnable Boundary Guided Adversarial Training","paper_url":"/paper/learnable-boundary-guided-adversarial","paper_date":"2020-11-23","arxiv_id":"2011.11164","code_links":[{"title":"fra31/auto-attack","url":"https://github.com/fra31/auto-attack"},{"title":"jiequancui/LBGAT","url":"https://github.com/jiequancui/LBGAT"},{"title":"dvlab-research/LBGAT","url":"https://github.com/dvlab-research/LBGAT"}],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-imagenet","slug":"adversarial-defense-on-imagenet","dataset":"ImageNet","dataset_url":"/dataset/imagenet","rows_in_archive":3,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"ResNet101","paper_title":"NOMARO: Defending against Adversarial Attacks by NOMA-Inspired Reconstruction Operation","paper_url":"/paper/nomaro-defending-against-adversarial-attacks","paper_date":"2021-12-14","arxiv_id":null,"code_links":[{"title":"as791/NOMARO_defense","url":"https://github.com/as791/NOMARO_defense"}],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-imagenet-targeted-pgd","slug":"adversarial-defense-on-imagenet-targeted-pgd","dataset":"ImageNet (targeted PGD, max perturbation=16)","dataset_url":null,"rows_in_archive":3,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"ResNet-152 Denoise","paper_title":"Feature Denoising for Improving Adversarial Robustness","paper_url":"/paper/feature-denoising-for-improving-adversarial","paper_date":"2018-12-09","arxiv_id":"1812.03411","code_links":[{"title":"facebookresearch/ImageNet-Adversarial-Training","url":"https://github.com/facebookresearch/ImageNet-Adversarial-Training"},{"title":"lirundong/quant-pack","url":"https://github.com/lirundong/quant-pack"}],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-mnist","slug":"adversarial-defense-on-mnist","dataset":"MNIST","dataset_url":"/dataset/mnist","rows_in_archive":2,"metrics":["Accuracy","Inference speed"],"first_row_in_archive_order":{"model":"Defense GAN","paper_title":"Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models","paper_url":"/paper/defense-gan-protecting-classifiers-against","paper_date":"2018-05-17","arxiv_id":"1805.06605","code_links":[{"title":"kabkabm/defensegan","url":"https://github.com/kabkabm/defensegan"},{"title":"mnswdhw/DefenseGAN-and-Cowboy-Defense","url":"https://github.com/mnswdhw/DefenseGAN-and-Cowboy-Defense"},{"title":"RSMung/DefenseGAN-pytorch","url":"https://github.com/RSMung/DefenseGAN-pytorch"},{"title":"mnswdhw/InvGAN-Pytorch","url":"https://github.com/mnswdhw/InvGAN-Pytorch"},{"title":"bibin-sebastian/Physical_Adversarial_examples_GAN","url":"https://github.com/bibin-sebastian/Physical_Adversarial_examples_GAN"}],"syntology":{"n":5,"n_ran":2,"n_unverified":3,"n_pointer_only":4}}},{"leaderboard":"/sota/adversarial-defense-on-caad-2018","slug":"adversarial-defense-on-caad-2018","dataset":"CAAD 2018","dataset_url":null,"rows_in_archive":1,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"Feature Denoising","paper_title":"Feature Denoising for Improving Adversarial Robustness","paper_url":"/paper/feature-denoising-for-improving-adversarial","paper_date":"2018-12-09","arxiv_id":"1812.03411","code_links":[{"title":"facebookresearch/ImageNet-Adversarial-Training","url":"https://github.com/facebookresearch/ImageNet-Adversarial-Training"},{"title":"lirundong/quant-pack","url":"https://github.com/lirundong/quant-pack"}],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-miniimagenet","slug":"adversarial-defense-on-miniimagenet","dataset":"miniImageNet","dataset_url":"/dataset/mini-imagenet","rows_in_archive":1,"metrics":["Accuracy "],"first_row_in_archive_order":{"model":"Auto Encoder-Block Switching defense with GradCAM","paper_title":"An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks","paper_url":"/paper/an-integrated-auto-encoder-block-switching-1","paper_date":"2022-03-11","arxiv_id":"2203.10930","code_links":[{"title":"anirudh9784/Adversarial-Defense","url":"https://github.com/anirudh9784/Adversarial-Defense"},{"title":"anirudh9784/Adversarial-Attacks-and-Defences","url":"https://github.com/anirudh9784/Adversarial-Attacks-and-Defences"}],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-trojai-round-0","slug":"adversarial-defense-on-trojai-round-0","dataset":"TrojAI Round 0","dataset_url":null,"rows_in_archive":1,"metrics":["Detection Accuracy"],"first_row_in_archive_order":{"model":"Cassandra","paper_title":"Cassandra: Detecting Trojaned Networks from Adversarial Perturbations","paper_url":"/paper/cassandra-detecting-trojaned-networks-from","paper_date":"2020-07-28","arxiv_id":"2007.14433","code_links":[],"syntology":null}},{"leaderboard":"/sota/adversarial-defense-on-trojai-round-1","slug":"adversarial-defense-on-trojai-round-1","dataset":"TrojAI Round 1","dataset_url":null,"rows_in_archive":1,"metrics":["Detection Accuracy"],"first_row_in_archive_order":{"model":"Cassandra","paper_title":"Cassandra: Detecting Trojaned Networks from Adversarial Perturbations","paper_url":"/paper/cassandra-detecting-trojaned-networks-from","paper_date":"2020-07-28","arxiv_id":"2007.14433","code_links":[],"syntology":null}}],"datasets":[{"url":"/dataset/cifar-10","name":"CIFAR-10","full_name":"CIFAR-10","num_papers_in_archive":16145},{"url":"/dataset/imagenet","name":"ImageNet","full_name":"","num_papers_in_archive":15430},{"url":"/dataset/cifar-100","name":"CIFAR-100","full_name":"","num_papers_in_archive":9045},{"url":"/dataset/mnist","name":"MNIST","full_name":"","num_papers_in_archive":7651},{"url":"/dataset/icons-50","name":"Icons-50","full_name":"","num_papers_in_archive":2}],"subtasks":[{"url":"/task/adversarial-purification","name":"Adversarial Purification"},{"url":"/task/provable-adversarial-defense","name":"Provable Adversarial Defense"}],"parent_tasks":[],"papers":{"order":"repositories listed in the archive (desc), then date (desc); the archive holds no stars","population":"papers tagged with this task that list at least one repository in the archive","shown":30,"of":216,"tagged_in_all":403,"items":[{"url":"/paper/towards-deep-learning-models-resistant-to","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","date":"2017-06-19","arxiv_id":"1706.06083","repositories_listed":59,"syntology":{"n":17,"n_ran":9,"n_unverified":8,"n_pointer_only":13}},{"url":"/paper/benchmarking-neural-network-robustness-to-2","title":"Benchmarking Neural Network Robustness to Common Corruptions and Perturbations","date":"2019-03-28","arxiv_id":"1903.12261","repositories_listed":14,"syntology":{"n":3,"n_ran":2,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/technical-report-on-the-cleverhans-v210","title":"Technical Report on the CleverHans v2.1.0 Adversarial Examples Library","date":"2016-10-03","arxiv_id":"1610.00768","repositories_listed":13,"syntology":{"n":26,"n_ran":3,"n_unverified":23,"n_pointer_only":26}},{"url":"/paper/certified-adversarial-robustness-via","title":"Certified Adversarial Robustness via Randomized Smoothing","date":"2019-02-08","arxiv_id":"1902.02918","repositories_listed":12,"syntology":null},{"url":"/paper/the-limitations-of-deep-learning-in","title":"The Limitations of Deep Learning in Adversarial Settings","date":"2015-11-24","arxiv_id":"1511.07528","repositories_listed":11,"syntology":null},{"url":"/paper/theoretically-principled-trade-off-between","title":"Theoretically Principled Trade-off between Robustness and Accuracy","date":"2019-01-24","arxiv_id":"1901.08573","repositories_listed":9,"syntology":{"n":15,"n_ran":12,"n_unverified":3,"n_pointer_only":4}},{"url":"/paper/adversarial-training-for-free","title":"Adversarial Training for Free!","date":"2019-04-29","arxiv_id":"1904.12843","repositories_listed":6,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":1}},{"url":"/paper/enresnet-resnet-ensemble-via-the-feynman-kac","title":"ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies","date":"2018-11-26","arxiv_id":"1811.10745","repositories_listed":5,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":1}},{"url":"/paper/defense-gan-protecting-classifiers-against","title":"Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models","date":"2018-05-17","arxiv_id":"1805.06605","repositories_listed":5,"syntology":{"n":5,"n_ran":2,"n_unverified":3,"n_pointer_only":4}},{"url":"/paper/zoo-zeroth-order-optimization-based-black-box","title":"ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models","date":"2017-08-14","arxiv_id":"1708.03999","repositories_listed":5,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/decoupled-kullback-leibler-divergence-loss","title":"Decoupled Kullback-Leibler Divergence Loss","date":"2023-05-23","arxiv_id":"2305.13948","repositories_listed":4,"syntology":{"n":11,"n_ran":7,"n_unverified":4,"n_pointer_only":4}},{"url":"/paper/on-evaluating-adversarial-robustness","title":"On Evaluating Adversarial Robustness","date":"2019-02-18","arxiv_id":"1902.06705","repositories_listed":4,"syntology":null},{"url":"/paper/obfuscated-gradients-give-a-false-sense-of","title":"Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples","date":"2018-02-01","arxiv_id":"1802.00420","repositories_listed":4,"syntology":null},{"url":"/paper/certified-defenses-against-adversarial","title":"Certified Defenses against Adversarial Examples","date":"2018-01-29","arxiv_id":"1801.09344","repositories_listed":4,"syntology":null},{"url":"/paper/learning-deep-compositional-grammatical","title":"AOGNets: Compositional Grammatical Architectures for Deep Learning","date":"2017-11-15","arxiv_id":"1711.05847","repositories_listed":4,"syntology":{"n":8,"n_ran":0,"n_unverified":8,"n_pointer_only":1}},{"url":"/paper/advfas-a-robust-face-anti-spoofing-framework","title":"AdvFAS: A robust face anti-spoofing framework against adversarial examples","date":"2023-08-04","arxiv_id":"2308.02116","repositories_listed":3,"syntology":null},{"url":"/paper/robust-classification-via-a-single-diffusion","title":"Robust Classification via a Single Diffusion Model","date":"2023-05-24","arxiv_id":"2305.15241","repositories_listed":3,"syntology":{"n":3,"n_ran":0,"n_unverified":3,"n_pointer_only":3}},{"url":"/paper/learnable-boundary-guided-adversarial","title":"Learnable Boundary Guided Adversarial Training","date":"2020-11-23","arxiv_id":"2011.11164","repositories_listed":3,"syntology":null},{"url":"/paper/ensembles-of-many-diverse-weak-defenses-can","title":"ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense","date":"2020-01-02","arxiv_id":"2001.00308","repositories_listed":3,"syntology":{"n":8,"n_ran":0,"n_unverified":8,"n_pointer_only":0}},{"url":"/paper/190808016","title":"Testing Robustness Against Unforeseen Adversaries","date":"2019-08-21","arxiv_id":"1908.08016","repositories_listed":3,"syntology":{"n":18,"n_ran":3,"n_unverified":15,"n_pointer_only":3}},{"url":"/paper/provably-robust-deep-learning-via","title":"Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers","date":"2019-06-09","arxiv_id":"1906.04584","repositories_listed":3,"syntology":{"n":3,"n_ran":1,"n_unverified":2,"n_pointer_only":0}},{"url":"/paper/robust-decision-trees-against-adversarial","title":"Robust Decision Trees Against Adversarial Examples","date":"2019-02-27","arxiv_id":"1902.10660","repositories_listed":3,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":1}},{"url":"/paper/advertorch-v01-an-adversarial-robustness","title":"advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch","date":"2019-02-20","arxiv_id":"1902.07623","repositories_listed":3,"syntology":{"n":1,"n_ran":0,"n_unverified":1,"n_pointer_only":1}},{"url":"/paper/sample-correlation-for-fingerprinting-deep","title":"Sample Correlation for Fingerprinting Deep Face Recognition","date":"2024-12-30","arxiv_id":"2412.20768","repositories_listed":2,"syntology":null},{"url":"/paper/dad-improved-data-free-test-time-adversarial","title":"DAD++: Improved Data-free Test Time Adversarial Defense","date":"2023-09-10","arxiv_id":"2309.05132","repositories_listed":2,"syntology":null},{"url":"/paper/critical-points-an-agile-point-cloud","title":"Robustifying Point Cloud Networks by Refocusing","date":"2023-08-10","arxiv_id":"2308.05525","repositories_listed":2,"syntology":{"n":22,"n_ran":15,"n_unverified":7,"n_pointer_only":22}},{"url":"/paper/smug-towards-robust-mri-reconstruction-by","title":"SMUG: Towards robust MRI reconstruction by smoothed unrolling","date":"2023-03-14","arxiv_id":"2303.12735","repositories_listed":2,"syntology":null},{"url":"/paper/visual-prompting-for-adversarial-robustness","title":"Visual Prompting for Adversarial Robustness","date":"2022-10-12","arxiv_id":"2210.06284","repositories_listed":2,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/lpf-defense-3d-adversarial-defense-based-on","title":"LPF-Defense: 3D Adversarial Defense based on Frequency Analysis","date":"2022-02-23","arxiv_id":"2202.11287","repositories_listed":2,"syntology":null},{"url":"/paper/revisiting-and-advancing-fast-adversarial-1","title":"Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimization","date":"2021-12-23","arxiv_id":"2112.12376","repositories_listed":2,"syntology":null}],"syntology_records":18,"syntology_note":"a paper without a record is not a recorded non-run: it may lack an arXiv id or simply be absent from the graph layer"},"description_links":{"kept":0,"unwrapped_to_text":0,"bare_urls_linked":0,"relative_images_dropped":0,"rule":"internal links are kept only when the target slug exists in the catalog"},"syntology":{"read_at":"2026-09-24T18:15:14+00:00","claim":"Per-sample execution status on synthesized fixtures ('ran N of M samples'); not a correctness claim and not a ranking signal.","status_vocabulary":{"ran_honours":"ran, honoured the contract we drafted","ran_violates":"ran, violated the contract we drafted","ran_draft_wrong":"ran; our contract draft was wrong, not the code","ran_fixture":"ran; our fixture could not drive it","ran":"ran on a synthesized input","unverified":"unverified (harvested, no recorded run)"}},"not_shown":{"libraries":"the archive has no per-task library table","trend_sparklines":"the Trend column of the benchmarks table was a rendered image; it is not in the archive","social_and_latest_sorts":"stars and social signals are not in the archive"}}