{"url":"/task/adversarial-robustness","name":"Adversarial Robustness","slug":"adversarial-robustness","description_markdown":"Adversarial Robustness evaluates the vulnerabilities of machine learning models under various types of adversarial attacks.","categories":[{"name":"Adversarial","url":"/area/adversarial"}],"source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","slug_source":"archive_url"},"counts":{"papers_tagged":1746,"papers_with_code":788,"benchmarks":7,"benchmark_tables_in_archive":7,"benchmark_tables_shown":7,"benchmark_tables_withheld_as_spam":0,"benchmark_definition":"a leaderboard table with at least one row; benchmark_tables_shown also counts the zero-row tables; benchmark_tables_in_archive adds the tables withheld as spam","datasets":13,"subtasks":0,"parent_tasks":0},"benchmarks":[{"leaderboard":"/sota/adversarial-robustness-on-advglue","slug":"adversarial-robustness-on-advglue","dataset":"AdvGLUE","dataset_url":"/dataset/advglue","rows_in_archive":10,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"DeBERTa (single model)","paper_title":"Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models","paper_url":"/paper/adversarial-glue-a-multi-task-benchmark-for","paper_date":"2021-11-04","arxiv_id":"2111.02840","code_links":[{"title":"ai-secure/adversarial-glue","url":"https://github.com/ai-secure/adversarial-glue"}],"syntology":null}},{"leaderboard":"/sota/adversarial-robustness-on-cifar-10","slug":"adversarial-robustness-on-cifar-10","dataset":"CIFAR-10","dataset_url":"/dataset/cifar-10","rows_in_archive":5,"metrics":["Accuracy","Robust Accuracy","Attack: AutoAttack"],"first_row_in_archive_order":{"model":"Mixed classifier","paper_title":"Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothing","paper_url":"/paper/improving-the-accuracy-robustness-trade-off","paper_date":"2023-01-29","arxiv_id":"2301.12554","code_links":[{"title":"codelion/adaptive-classifier","url":"https://github.com/codelion/adaptive-classifier"},{"title":"bai-yt/adaptivesmoothing","url":"https://github.com/bai-yt/adaptivesmoothing"}],"syntology":{"n":8,"n_ran":0,"n_unverified":8,"n_pointer_only":0}}},{"leaderboard":"/sota/adversarial-robustness-on-imagenet","slug":"adversarial-robustness-on-imagenet","dataset":"ImageNet","dataset_url":"/dataset/imagenet","rows_in_archive":4,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"ResNet-50 (SGD, Cosine)","paper_title":"Are Transformers More Robust Than CNNs?","paper_url":"/paper/are-transformers-more-robust-than-cnns","paper_date":"2021-11-10","arxiv_id":"2111.05464","code_links":[{"title":"ytongbai/ViTs-vs-CNNs","url":"https://github.com/ytongbai/ViTs-vs-CNNs"}],"syntology":null}},{"leaderboard":"/sota/adversarial-robustness-on-imagenet-a","slug":"adversarial-robustness-on-imagenet-a","dataset":"ImageNet-A","dataset_url":"/dataset/imagenet-a","rows_in_archive":4,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"DeiT-S (AdamW, Cosine)","paper_title":"Are Transformers More Robust Than CNNs?","paper_url":"/paper/are-transformers-more-robust-than-cnns","paper_date":"2021-11-10","arxiv_id":"2111.05464","code_links":[{"title":"ytongbai/ViTs-vs-CNNs","url":"https://github.com/ytongbai/ViTs-vs-CNNs"}],"syntology":null}},{"leaderboard":"/sota/adversarial-robustness-on-imagenet-c","slug":"adversarial-robustness-on-imagenet-c","dataset":"ImageNet-C","dataset_url":"/dataset/imagenet-c","rows_in_archive":4,"metrics":["mean Corruption Error (mCE)"],"first_row_in_archive_order":{"model":"DeiT-S (AdamW, Cosine)","paper_title":"Are Transformers More Robust Than CNNs?","paper_url":"/paper/are-transformers-more-robust-than-cnns","paper_date":"2021-11-10","arxiv_id":"2111.05464","code_links":[{"title":"ytongbai/ViTs-vs-CNNs","url":"https://github.com/ytongbai/ViTs-vs-CNNs"}],"syntology":null}},{"leaderboard":"/sota/adversarial-robustness-on-stylized-imagenet","slug":"adversarial-robustness-on-stylized-imagenet","dataset":"Stylized ImageNet","dataset_url":"/dataset/stylized-imagenet","rows_in_archive":4,"metrics":["Accuracy"],"first_row_in_archive_order":{"model":"DeiT-S (AdamW, Cosine)","paper_title":"Are Transformers More Robust Than CNNs?","paper_url":"/paper/are-transformers-more-robust-than-cnns","paper_date":"2021-11-10","arxiv_id":"2111.05464","code_links":[{"title":"ytongbai/ViTs-vs-CNNs","url":"https://github.com/ytongbai/ViTs-vs-CNNs"}],"syntology":null}},{"leaderboard":"/sota/adversarial-robustness-on-cifar-100","slug":"adversarial-robustness-on-cifar-100","dataset":"CIFAR-100","dataset_url":"/dataset/cifar-100","rows_in_archive":2,"metrics":["Clean Accuracy","AutoAttacked Accuracy"],"first_row_in_archive_order":{"model":"Mixed Classifier","paper_title":"Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothing","paper_url":"/paper/improving-the-accuracy-robustness-trade-off","paper_date":"2023-01-29","arxiv_id":"2301.12554","code_links":[{"title":"codelion/adaptive-classifier","url":"https://github.com/codelion/adaptive-classifier"},{"title":"bai-yt/adaptivesmoothing","url":"https://github.com/bai-yt/adaptivesmoothing"}],"syntology":{"n":8,"n_ran":0,"n_unverified":8,"n_pointer_only":0}}}],"datasets":[{"url":"/dataset/cifar-10","name":"CIFAR-10","full_name":"CIFAR-10","num_papers_in_archive":16145},{"url":"/dataset/imagenet","name":"ImageNet","full_name":"","num_papers_in_archive":15430},{"url":"/dataset/cifar-100","name":"CIFAR-100","full_name":"","num_papers_in_archive":9045},{"url":"/dataset/imagenet-c","name":"ImageNet-C","full_name":"ImageNet-C","num_papers_in_archive":602},{"url":"/dataset/imagenet-a","name":"ImageNet-A","full_name":"","num_papers_in_archive":431},{"url":"/dataset/stylized-imagenet","name":"Stylized ImageNet","full_name":"Stylized ImageNet","num_papers_in_archive":106},{"url":"/dataset/advglue","name":"AdvGLUE","full_name":"Adversarial GLUE","num_papers_in_archive":36},{"url":"/dataset/imagenet-patch","name":"ImageNet-Patch","full_name":"","num_papers_in_archive":5},{"url":"/dataset/clear-bias","name":"CLEAR-Bias","full_name":"Corpus for Linguistic Evaluation of Adversarial Robustness against Bias","num_papers_in_archive":2},{"url":"/dataset/advsuffixes","name":"AdvSuffixes","full_name":"Adversarial Suffixes","num_papers_in_archive":1},{"url":"/dataset/osn-transmission-mini-celeba","name":"OSN-transmission_mini_CelebA","full_name":"","num_papers_in_archive":1},{"url":"/dataset/shadr","name":"SHADR","full_name":"sythetic SDoH Human Annotated Demographic Robustness dataset (SHADR)","num_papers_in_archive":1},{"url":"/dataset/speech-robust-bench","name":"Speech Robust Bench","full_name":"","num_papers_in_archive":1}],"subtasks":[],"parent_tasks":[],"papers":{"order":"repositories listed in the archive (desc), then date (desc); the archive holds no stars","population":"papers tagged with this task that list at least one repository in the archive","shown":30,"of":788,"tagged_in_all":1746,"items":[{"url":"/paper/towards-deep-learning-models-resistant-to","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","date":"2017-06-19","arxiv_id":"1706.06083","repositories_listed":59,"syntology":{"n":17,"n_ran":9,"n_unverified":8,"n_pointer_only":13}},{"url":"/paper/certified-adversarial-robustness-via","title":"Certified Adversarial Robustness via Randomized Smoothing","date":"2019-02-08","arxiv_id":"1902.02918","repositories_listed":12,"syntology":null},{"url":"/paper/generating-adversarial-examples-with","title":"Generating Adversarial Examples with Adversarial Networks","date":"2018-01-08","arxiv_id":"1801.02610","repositories_listed":10,"syntology":null},{"url":"/paper/theoretically-principled-trade-off-between","title":"Theoretically Principled Trade-off between Robustness and Accuracy","date":"2019-01-24","arxiv_id":"1901.08573","repositories_listed":9,"syntology":{"n":15,"n_ran":12,"n_unverified":3,"n_pointer_only":4}},{"url":"/paper/reliable-evaluation-of-adversarial-robustness","title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","date":"2020-03-03","arxiv_id":"2003.01690","repositories_listed":8,"syntology":{"n":5,"n_ran":3,"n_unverified":2,"n_pointer_only":4}},{"url":"/paper/robustness-may-be-at-odds-with-accuracy","title":"Robustness May Be at Odds with Accuracy","date":"2018-05-30","arxiv_id":"1805.12152","repositories_listed":8,"syntology":null},{"url":"/paper/fixing-data-augmentation-to-improve","title":"Fixing Data Augmentation to Improve Adversarial Robustness","date":"2021-03-02","arxiv_id":"2103.01946","repositories_listed":7,"syntology":null},{"url":"/paper/adversarial-robustness-toolbox-v040","title":"Adversarial Robustness Toolbox v1.0.0","date":"2018-07-03","arxiv_id":"1807.01069","repositories_listed":7,"syntology":null},{"url":"/paper/improving-adversarial-robustness-via","title":"Improving Adversarial Robustness via Promoting Ensemble Diversity","date":"2019-01-25","arxiv_id":"1901.08846","repositories_listed":6,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/ead-elastic-net-attacks-to-deep-neural","title":"EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples","date":"2017-09-13","arxiv_id":"1709.04114","repositories_listed":6,"syntology":{"n":1,"n_ran":0,"n_unverified":1,"n_pointer_only":1}},{"url":"/paper/provably-bounding-neural-network-preimages-1","title":"Provably Bounding Neural Network Preimages","date":"2023-02-02","arxiv_id":"2302.01404","repositories_listed":5,"syntology":{"n":6,"n_ran":0,"n_unverified":6,"n_pointer_only":6}},{"url":"/paper/190600945","title":"Adversarial Robustness as a Prior for Learned Representations","date":"2019-06-03","arxiv_id":"1906.00945","repositories_listed":5,"syntology":null},{"url":"/paper/improving-alignment-and-robustness-with-short","title":"Improving Alignment and Robustness with Circuit Breakers","date":"2024-06-06","arxiv_id":"2406.04313","repositories_listed":4,"syntology":{"n":6,"n_ran":3,"n_unverified":3,"n_pointer_only":1}},{"url":"/paper/decoupled-kullback-leibler-divergence-loss","title":"Decoupled Kullback-Leibler Divergence Loss","date":"2023-05-23","arxiv_id":"2305.13948","repositories_listed":4,"syntology":{"n":11,"n_ran":7,"n_unverified":4,"n_pointer_only":4}},{"url":"/paper/demystifying-self-supervised-trojan-attacks","title":"An Embarrassingly Simple Backdoor Attack on Self-supervised Learning","date":"2022-10-13","arxiv_id":"2210.07346","repositories_listed":4,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":2}},{"url":"/paper/uncovering-the-limits-of-adversarial-training","title":"Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples","date":"2020-10-07","arxiv_id":"2010.03593","repositories_listed":4,"syntology":null},{"url":"/paper/unlabeled-data-improves-adversarial","title":"Unlabeled Data Improves Adversarial Robustness","date":"2019-05-31","arxiv_id":"1905.13736","repositories_listed":4,"syntology":{"n":8,"n_ran":1,"n_unverified":7,"n_pointer_only":0}},{"url":"/paper/on-evaluating-adversarial-robustness","title":"On Evaluating Adversarial Robustness","date":"2019-02-18","arxiv_id":"1902.06705","repositories_listed":4,"syntology":null},{"url":"/paper/s-zero-gradient-based-optimization-of-ell-0","title":"$σ$-zero: Gradient-based Optimization of $\\ell_0$-norm Adversarial Examples","date":"2024-02-02","arxiv_id":"2402.01879","repositories_listed":3,"syntology":{"n":15,"n_ran":10,"n_unverified":5,"n_pointer_only":13}},{"url":"/paper/robust-classification-via-a-single-diffusion","title":"Robust Classification via a Single Diffusion Model","date":"2023-05-24","arxiv_id":"2305.15241","repositories_listed":3,"syntology":{"n":3,"n_ran":0,"n_unverified":3,"n_pointer_only":3}},{"url":"/paper/certified-adversarial-robustness-for-free","title":"(Certified!!) Adversarial Robustness for Free!","date":"2022-06-21","arxiv_id":"2206.10550","repositories_listed":3,"syntology":{"n":34,"n_ran":14,"n_unverified":20,"n_pointer_only":0}},{"url":"/paper/fednest-federated-bilevel-minimax-and","title":"FedNest: Federated Bilevel, Minimax, and Compositional Optimization","date":"2022-05-04","arxiv_id":"2205.02215","repositories_listed":3,"syntology":{"n":4,"n_ran":2,"n_unverified":2,"n_pointer_only":2}},{"url":"/paper/pdpgd-primal-dual-proximal-gradient-descent","title":"PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack","date":"2021-06-03","arxiv_id":"2106.01538","repositories_listed":3,"syntology":{"n":3,"n_ran":2,"n_unverified":1,"n_pointer_only":1}},{"url":"/paper/fast-minimum-norm-adversarial-attacks-through","title":"Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints","date":"2021-02-25","arxiv_id":"2102.12827","repositories_listed":3,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/bridging-mode-connectivity-in-loss-landscapes-1","title":"Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness","date":"2020-04-30","arxiv_id":"2005.00060","repositories_listed":3,"syntology":{"n":2,"n_ran":1,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/revisiting-loss-landscape-for-adversarial","title":"Adversarial Weight Perturbation Helps Robust Generalization","date":"2020-04-13","arxiv_id":"2004.05884","repositories_listed":3,"syntology":{"n":5,"n_ran":2,"n_unverified":3,"n_pointer_only":0}},{"url":"/paper/190808016","title":"Testing Robustness Against Unforeseen Adversaries","date":"2019-08-21","arxiv_id":"1908.08016","repositories_listed":3,"syntology":{"n":18,"n_ran":3,"n_unverified":15,"n_pointer_only":3}},{"url":"/paper/interpolated-adversarial-training-achieving","title":"Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy","date":"2019-06-16","arxiv_id":"1906.06784","repositories_listed":3,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":2}},{"url":"/paper/advertorch-v01-an-adversarial-robustness","title":"advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch","date":"2019-02-20","arxiv_id":"1902.07623","repositories_listed":3,"syntology":{"n":1,"n_ran":0,"n_unverified":1,"n_pointer_only":1}},{"url":"/paper/second-order-adversarial-attack-and","title":"Certified Adversarial Robustness with Additive Noise","date":"2018-09-10","arxiv_id":"1809.03113","repositories_listed":3,"syntology":{"n":9,"n_ran":0,"n_unverified":9,"n_pointer_only":0}}],"syntology_records":22,"syntology_note":"a paper without a record is not a recorded non-run: it may lack an arXiv id or simply be absent from the graph layer"},"description_links":{"kept":0,"unwrapped_to_text":0,"bare_urls_linked":0,"relative_images_dropped":0,"rule":"internal links are kept only when the target slug exists in the catalog"},"syntology":{"read_at":"2026-09-24T18:15:14+00:00","claim":"Per-sample execution status on synthesized fixtures ('ran N of M samples'); not a correctness claim and not a ranking signal.","status_vocabulary":{"ran_honours":"ran, honoured the contract we drafted","ran_violates":"ran, violated the contract we drafted","ran_draft_wrong":"ran; our contract draft was wrong, not the code","ran_fixture":"ran; our fixture could not drive it","ran":"ran on a synthesized input","unverified":"unverified (harvested, no recorded run)"}},"not_shown":{"libraries":"the archive has no per-task library table","trend_sparklines":"the Trend column of the benchmarks table was a rendered image; it is not in the archive","social_and_latest_sorts":"stars and social signals are not in the archive"}}