Concept · 21 papers · updated 2026-11-01

Adversarial robustness

Adversarial robustness is a model's ability to keep its intended behaviour under deliberate input perturbation, poisoned data or attacks on its surroundings. Twenty-one cards cover surveys, text, image, multimodal, prompt, federated, backdoor and poisoning work. Numbers are author-reported under different threat models; do not compare them.

robustnessadversarial-attackstrustworthy-aievaluation

Markdown39 min read

AI-compiled overview, updated 2026-11-01, not yet reviewed by a human. Every claim cites its source; check it when a detail matters.

Overview

Adversarial robustness asks whether a model still behaves as intended when someone changes its inputs on purpose, or tampers with the data it was trained on. A trustworthiness survey treats it as one of eight aspects of trustworthy AI and widens robustness to coping with execution errors, bad inputs and unseen data 2110.01167 §2.1. This page covers the adversarial part only.

Twenty-one sources are on record, and they answer different questions:

The original adversarial-example paper finds small, optimised input changes that flip an image classifier's label, and reports that many of these changes also fool other networks 1312.6199 §4.2. Its unit-analysis part concerns interpretability and is not covered here 1312.6199 §3.
The trustworthiness survey gives a taxonomy of threats and defences, with no new method and no experiments 2110.01167 §1.
A targeted-attack paper on multimodal embedding models aligns an image with several text proxies and with benign image proxies. Its authors report success with and without an outlier-detection defence 2509.19994 §4.1 2509.19994 tab. 2.
A federated-learning method, Ditto, gives each device a personal model pulled toward the shared model. Under label, random-update and model-replacement attacks by some devices, the authors report higher mean benign accuracy than robust baselines 2012.04221 §1 2012.04221 §4.1.
An adversarial-training paper scores how well each PGD inner attack is solved, and lowers the score's threshold over epochs. The authors report higher CIFAR-10 white-box PGD-10 accuracy than standard PGD training 2112.08304 §4.1 2112.08304 tab. 1.
A graph-network paper reports robustness results under a structure attack. These are the authors' own numbers 2011.09643 §5.3.
A data-protection paper adds faint, bounded noise to images so that a model trained on them learns little. It is the reverse of a defence: the noise is the attack, used by the data owner 2101.04898 §1 2101.04898 §3.1.
A survey of LLM security lists prompt injection, jailbreaks, backdoors and poisoning, with defences. It runs no experiments of its own 2402.00888 §1 2402.00888 §9.
A clean-label poisoning paper plants training images that keep their correct labels. In several stand-in networks their features enclose a chosen target's features, so a victim that overfits them files the target under the poison class. The authors report transfer to victims they never trained against, at 1% poisoning 1905.05897 §4.1 1905.05897 abstract.
A benchmark attacks the instruction text of LLMs rather than the input sample. Seven text attacks on four prompt types are scored by how far they lower accuracy from the clean prompt. Word-level attacks cause the largest average drop in its table 2306.04528 TL;DR 2306.04528 tab. 2.
A position paper argues that failing under adversarial attack is one kind of deployment failure, and that functionality should be established before ethics is debated 2206.09511 §4.2.3 2206.09511 §6.
An image augmentation method reports one FGSM robustness result on ImageNet, as a side experiment next to its accuracy results 2006.01791 §4.4.
A survey of dataset security covers training-only poisoning, backdoors and their defences in one taxonomy. It runs no experiments and reports no numbers 2012.10544 §1 2012.10544 §5.
A backdoor repair method learns a mask per neuron under adversarial weight perturbation, then prunes low-mask neurons without fine-tuning. The authors report low attack success on CIFAR-10 with 1% of the training data 2110.14430 §3.3 2110.14430 tab. 1.
A benchmark builds adversarial text examples for five GLUE tasks and reports how language models score on them 2111.02840 §3.1 2111.02840 tab. 4.
A stress test of AI-text detectors shows how paraphrasing and spoofing change their accuracy 2303.11156 §2.3 2303.11156 §3.
A white-box study attacks an open vision-language model with imperceptible image perturbations and reports targeted and untargeted results 2308.10741 §4 2308.10741 tab. 2.
An anomaly-detection method for street scenes reuses its image resynthesis to flag adversarial inputs, with its own AUROC table 1904.07595 §3.3 1904.07595 tab. 1.
A black-box attack replaces words in a text input until a classifier or entailment model changes its label. The authors report BERT's accuracy under it on several sets 1907.11932 § Method, Step 2 1907.11932 tab. 3.
A black-box attack that takes its replacements and insertions from BERT's masked-LM guesses, filtered for sentence similarity and part of speech. Its results are compared with the same TextFooler baseline on seven sentiment, subjectivity and question-type sets 2004.01970 §2 2004.01970 §3.
A trust benchmark for GPT-4 and GPT-3.5 that includes an AdvGLUE robustness test and adversarial-demonstration tests, with author-reported results for two dated model snapshots 2306.11698 §2 2306.11698 §5 2306.11698 §7.

All variants share one goal: the system keeps its intended output under threats it was not designed for. They differ in where the threat enters: the input at decision time, the training data, or the system around the model 2110.01167 §2.1.

Perturbation rates appear in the graph paper (0% to 25%), which is its own setup. The FGSM strength in the augmentation paper is not stated 2006.01791 §4.4. Do not copy any number on this page into a new system without rerunning it.

Threats

Decision-time attacks perturb inputs to a deployed model 2110.01167 §2.1.
Training-time attacks (poisoning) inject samples into the training set 2110.01167 §2.1. Training-only poisoning needs no access at test time, while backdoors need a trigger at test time 2012.10544 §1 2012.10544 §3. The graph paper's attack perturbs the graph structure with Metattack at rates from 0% to 25% 2011.09643 §5.3.
Clean-label targeted poisoning. The poisoned training images keep their true labels, and the target image is not changed at test time. The attacker needs only similar training data, not the victim's outputs or weights 1905.05897 §2 1905.05897 TL;DR.
Prompt perturbations. The instruction text is damaged with typos, word swaps, appended distractors or translation round trips, while the input sample stays clean 2306.04528 §2.2.
Corrupted federated devices. In the federated setting the poisoned data or updates come from some devices. The Ditto paper considers label flipping (A1), Gaussian random updates (A2) and model replacement with scaled updates (A3) 2012.04221 §2.
Feature-space and problem-space attacks are listed as separate classes. The survey does not define each in the cited section 2110.01167 §2.1.
Model stealing is listed as an algorithm-level threat 2110.01167 §2.1.
System-level threats are illegal or malformed inputs and presentation (spoof) attacks 2110.01167 §2.1.
Text perturbations for classifiers come in word-level (typos, embedding or knowledge-based synonyms, contextual substitutions) and sentence-level forms (syntactic rewrites, appended distractions) 2111.02840 §3.2.1 2111.02840 §3.2.2.
Black-box word substitution. The attacker sees only the model's predictions and confidence scores. Words are ranked by how much removing each one shifts the label probability, then swapped for synonyms that keep the part of speech and pass a sentence-similarity check 1907.11932 § Method, Threat Model 1907.11932 § Method, Step 1 1907.11932 § Method, Step 2.
LLM prompt attacks. Prompt injection hides instructions in the input. Jailbreaking gets the model to ignore its safety rules. Both fall under prompt hacking 2402.00888 §3 2402.00888 §4.1.1 2402.00888 §4.1.2.
Backdoors hide a trigger in the training data so the model misbehaves when the trigger appears 2402.00888 §4.2.1. The dataset-security survey calls them trojans and sets them beside training-only poisoning 2012.10544 §3. The neuron-pruning paper treats the backdoored network as the object of repair, not of attack 2110.14430 §1.
Evasion and spoofing of AI-text detectors. The author of AI text paraphrases it to escape detection, or a person writes text that a detector flags as AI-written 2303.11156 §2.1 2303.11156 §3.
Image perturbations on vision-language models. A third party who supplies the picture adds a bounded, invisible change that steers the model's caption or answer. The attack needs the model's weights 2308.10741 §4.
Adversarial inputs to segmentation. Attacked images produce label maps that a resynthesis check can expose 1904.07595 §3.3.
Targeted embedding attacks on multimodal retrieval. The attacker makes an image match a chosen concept in a shared image-text space. A single exact target sentence fails on paraphrases, and attacked embeddings sit outside the benign data, where outlier detectors can flag them 2509.19994 §1 2509.19994 §3.3.

Variants

Empirical robustness evaluation

Robustness is measured by the minimal adversarial perturbation needed to change a decision. The survey also mentions robustness tests more generally 2110.01167 §2.1. Which attack, norm or budget to use is not stated. Card: Trustworthy AI: From Principles to Practices.

Minimal-perturbation search on image classifiers

The original paper defines an adversarial example as the nearest input, in L2 distance, that a classifier labels with a chosen target label 1312.6199 §4.1. Exact minimisation is hard, so the search approximates it. It finds the smallest penalty weight for which a box-constrained L-BFGS solve gives the target label, and it accepts a result only after checking that label 1312.6199 §4.1. The paper reports an example for every sample tested on MNIST, QuocNet and AlexNet. The QuocNet and AlexNet evidence is qualitative 1312.6199 §4.2 1312.6199 fig. 5 1312.6199 fig. 6.

Examples made for one MNIST model often fool another. Across six MNIST models, the off-diagonal error rates range from 2% to 87.1% 1312.6199 tab. 2. Models trained on disjoint halves of the training set show the same effect, with cross-model error from 5.1% to 26.2% on examples generated on the test set 1312.6199 tab. 4. The amplified rows of that table do not follow from the step formula given in the paper, so treat them as unverified 1312.6199 §4.2. The penalty term does not define its norm, so state which one you use 1312.6199 §4.1. Card: Intriguing properties of neural networks.

Layer-wise Lipschitz bound

The paper bounds how far a network can amplify an input change. The bound is the product of per-layer upper Lipschitz constants 1312.6199 §4.3. For a dense or rectified layer, the constant is at most the largest singular value of its weights. Max-pooling has bound 1, and contrast normalisation has bound ε^(−γ) 1312.6199 §4.3. Convolutions use a Fourier-domain formula 1312.6199 eq. 1. The reported bounds for the five convolutional layers of an ImageNet network lie between 2.75 and 11 1312.6199 tab. 5.

The bound is one-sided. A large bound does not imply that adversarial examples exist, but a small bound guarantees that none do 1312.6199 §4.3. The authors suggest penalising these bounds during training, but they do not test it 1312.6199 §4.3. The exponent in the convolution formula has N² where the usual 2-D Fourier transform has N, so check it numerically before use 1312.6199 eq. 1. Card: Intriguing properties of neural networks.

Robustness benchmark for text classifiers

AdvGLUE is a test set for five GLUE tasks: SST-2, QQP, MNLI, QNLI and RTE 2111.02840 §3.1. Its examples come from 14 attack entries, grouped into 11 columns. CheckList and StressTest each appear twice, so 12 distinct methods are used 2111.02840 §3.2.3 2111.02840 tab. 1. Examples are generated against BERT, RoBERTa and a RoBERTa ensemble, kept only if the other surrogates also change their prediction, and then checked by crowd workers 2111.02840 §3.2 2111.02840 §3.3. The public split is the dev set; test scores need a hidden-set submission 2111.02840 §3.5.

Author-reported, the AdvGLUE averages of ten models range from 30.29 (SMART, BERT) to 60.86 (DeBERTa, Large). The GLUE averages of the same models range from 85.70 to 93.16 2111.02840 tab. 4. The authors present it as a diagnostic test beside GLUE, not a replacement 2111.02840 app. A.8. Card: Adversarial GLUE.

Black-box word substitution for text classifiers

The attack ranks the words of an input by how much deleting each one shifts the label probability 1907.11932 § Method, Step 1 1907.11932 eq. 2. It then visits the words from most to least important. For each word it tries synonyms that keep the part of speech and pass a similarity check, and it stops at the first swap that flips the label 1907.11932 § Method, Step 2 1907.11932 alg. 1. The authors apply it to text classification and to entailment, against WordCNN, WordLSTM and BERT 1907.11932 § Experiments. Author-reported, on 1,000 test examples, BERT's accuracy falls to 6.6% on Yelp with 13.9% of words changed, and to 4.0% on SNLI with 18.5% changed 1907.11932 tab. 3 1907.11932 tab. 4. Two native speakers judged 100 examples per task. Label agreement with the original text was 92% on MR and 85% on SNLI 1907.11932 § Results, Human Evaluation. Against three earlier text attacks, the authors report higher success rates on the datasets they compare, and lower word-change rates where those are given 1907.11932 tab. 5.

The ablations show what each part contributes. Choosing words at random instead of by importance leaves BERT at 68.3% on MR, against 11.5% with the ranking 1907.11932 tab. 8. Dropping the similarity check lowers the MR after-attack accuracy from 11.5% to 6.2%, but also lowers the similarity score from 0.65 to 0.58 1907.11932 tab. 10. Examples made for one model lower the accuracy of the other models only partly, by different amounts 1907.11932 tab. 11.

The released code differs from the paper in its synonym threshold, its similarity scale and its similarity window. The paper does not say which setting produced its results 1907.11932 § Paper vs code. Reproduce with the code's settings in view. Card: Is BERT Really Robust?.

Masked-LM replacement and insertion for text classifiers

The attack ranks tokens by how much deleting each one lowers the probability of the true label, as the word-substitution attack does. It then masks each position in that order and keeps the 50 most likely BERT fillers 2004.01970 §2 2004.01970 app. A 2004.01970 alg. 1. Candidates must pass a Universal Sentence Encoder similarity check at 0.8, and replacements must keep the original part of speech 2004.01970 app. A. There are four modes: replace only, insert only, replace or insert per token, and replace then insert 2004.01970 §2.

Author-reported, on BERT with the replace-then-insert mode, test accuracy falls from 96.0% to 14.0% on Amazon and from 85.28% to 19.21% on MR. TextFooler gives 30.0% and 30.74% on the same sets 2004.01970 tab. 1. Replacement-only is the weak case for BERT: TextFooler gives lower accuracy than BAE-R on six of seven datasets, and BAE-R is lower only on TREC 2004.01970 tab. 1 2004.01970 tab. 2. A small human study on three datasets rates BAE-R more natural than TextFooler on a 1 to 5 scale, at 3.84 against 3.35 on MR 2004.01970 tab. 3. The authors also note that the similarity score can rate replace-then-insert higher than replace-only, while humans rate it lower 2004.01970 §3. Card: BAE: BERT-based Adversarial Examples for Text Classification.

Adversarial training

Adversarial samples are added to the training data, so the model learns to resist them 2110.01167 §3.2.1. The survey notes that this defends mainly against the attack types used in training and can stay vulnerable to others 2110.01167 §3.2.1. It also says adversarial training can lower test accuracy, which creates tension with generalization 2110.01167 §2.2. No training recipe or result is given from the survey. A text-attack paper reports one run in which adding attacked MR and SNLI training examples raised BERT's after-attack accuracy on MR from 11.5% to 18.7%. The attack stayed effective, with 21.0% of words changed 1907.11932 tab. 12. The original adversarial-example paper reports one preliminary run: a 100-100-10 network trained with adversarial examples reached below 1.2% test error, against 1.6% with weight decay alone and about 1.3% with dropout. It gives no variance and does not state the example pool, its replacement rate or its schedule 1312.6199 §4.2. Cards: Trustworthy AI: From Principles to Practices, Intriguing properties of neural networks.

Dynamic inner-attack schedule for adversarial training

Standard PGD adversarial training runs the same inner attack on every batch. This variant scores each PGD example by a first-order stationarity measure, FOSC, which is nonnegative and falls toward zero as the attack improves 2112.08304 §3.1 2112.08304 eq. 4. An example stops being attacked once its score is at or below an epoch threshold, and that threshold falls linearly from c_max to zero over the first T′ epochs 2112.08304 §4.1 2112.08304 alg. 1. Early epochs therefore train on weaker attacks and later epochs on stronger ones. The paper reads the early, low FOSC values as overfitting to strong PGD examples, and reports that replacing the first 20 epochs of PGD with one-step FGSM gives higher final robustness 2112.08304 §3.2 2112.08304 fig. 3.

Author-reported, on CIFAR-10 with an 8-layer CNN, white-box PGD-10 accuracy is 48.06% against 44.39% for standard PGD training and 45.54% for the curriculum baseline. On MNIST the PGD-10 gain is 0.42 points 2112.08304 tab. 1. Black-box PGD-10 accuracy on CIFAR-10 is 72.15% against 65.80% for standard training 2112.08304 tab. 2. In the WideResNet setting that follows Madry et al., PGD-20 accuracy rises to 48.70% from 45.8%, but clean accuracy falls to 85.03% from 87.3% 2112.08304 tab. 3. The paper fixes c_max at 0.5 and does not estimate it from FGSM examples, although it suggests doing so 2112.08304 §4.1 2112.08304 §5.1. Its convergence result depends on constants that the experiments do not estimate 2112.08304 §4.2.

The released code differs from the paper in three ways. It keeps running every PGD step and freezes finished examples with a mask, so the stop rule saves no compute 2112.08304 § Pitfalls. It weights each example's loss by its adversarial cross-entropy from the second epoch on, which the paper does not describe. It also passes weight decay as a Keras learning-rate decay argument 2112.08304 § Paper vs code. Algorithm 1 as printed has an inverted control indicator; the comment and the code freeze examples at or below the threshold 2112.08304 alg. 1. Card: On the Convergence and Robustness of Adversarial Training.

Augmentation for image robustness

SaliencyMix pastes a patch from one training image onto another. The patch is placed around the most salient pixel of the source, and the labels are mixed by patch area 2006.01791 §3.1 2006.01791 §3.2. On ImageNet with ResNet-50, the authors report FGSM top-1 accuracy of 32.96%, against 31.0% for CutMix and 8.2% for the baseline 2006.01791 §4.4 2006.01791 tab. 4. The attack strength (ε) is not stated, so this result cannot be reproduced from the paper alone 2006.01791 §4.4. The robustness result is one of several experiments; the main tables report clean error rates 2006.01791 tab. 1 2006.01791 tab. 2. Card: SaliencyMix.

Clean-label poisoning that transfers to unseen victims

The attacker keeps each poison's true label. The poisons are chosen so that, in the features of several substitute networks, the target's features fall inside the convex hull of the poisons' features 1905.05897 §3.3 1905.05897 eq. 3. The substitutes are trained on similar data, and the victim is never queried 1905.05897 §2. Dropout is kept on in the substitutes while the poisons are crafted 1905.05897 §3.6. For a frozen pretrained extractor with only a linear head fine-tuned, the single-layer objective is used. For end-to-end training, the paper uses a multi-layer variant that draws features from several layers 1905.05897 §3.5 1905.05897 eq. 4. The single-layer form gives almost zero success after end-to-end training 1905.05897 §4.3.

Author-reported, on CIFAR-10 with one frog target and five ship poisons, which is 1% of the 500 fine-tuning images 1905.05897 §4, the convex polytope attack is at or near 0.5 transfer success for most victims. Feature collision never exceeds 0.5 in the same transfer setting 1905.05897 §4.1. The abstract puts the headline at over 50% 1905.05897 abstract. The per-victim rates are shown only in a figure 1905.05897 fig. 5. With multi-layer features, the authors report success above 0.6 for every gray-box victim, with GoogLeNet the hardest case 1905.05897 §4.3 1905.05897 fig. 7.

The released repository contains the convex polytope routine only. It has no feature-collision baseline and no poisons, and it has no script that computes a success rate 1905.05897 § Paper vs code. The paper also leaves open how far the victim must overfit before the attack works 1905.05897 §4. Substitute Dropout must stay active while crafting, because a plain evaluation mode switches it off in the released code 1905.05897 § Pitfalls. Each model and each poison set needs its own coefficients 1905.05897 §3.3. Card: Transferable Clean-Label Poisoning Attacks on Deep Neural Nets.

Poisoning defences

Algorithm design includes poisoning defences under adversarial robustness 2110.01167 §3.2.1. The trustworthiness survey names no specific defence. Upstream, data provenance (recording source and processing steps) and anomaly detection in preprocessing are listed as data-stage measures 2110.01167 §3.1.1 2110.01167 §3.1.2. Card: Trustworthy AI: From Principles to Practices.

The dataset-security survey sorts defences into detection of poisoned data, detection of poisoned models, post-training repair, and training-time defences. The last group covers certified smoothing, majority votes, differential privacy and input preprocessing 2012.10544 §4.1 2012.10544 §4.2 2012.10544 §4.3 2012.10544 §4.4. It warns that outlier-based detection can be bypassed by adaptive poisons placed close together 2012.10544 §4.1.1, and that certified defences are far from meaningful guarantees at realistic scale 2012.10544 §4.6. It compares no methods with numbers. Card: Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses.

Backdoor repair after training by neuron pruning

Adversarial Neuron Pruning works on a backdoored network that the defender did not train. It assumes the trigger is unknown and that a small clean set is available. The method learns a mask in [0, 1] for each neuron while weights and biases are worst-case perturbed, then prunes neurons whose mask falls below 0.2. The remaining weights are not changed and no fine-tuning is done 2110.14430 §3.3 2110.14430 §4.1. The paper's motivating experiment finds that backdoored networks misclassify more under such perturbations, and mostly into the target label 2110.14430 §3.2. The authors attribute this to backdoor neurons that are dormant on clean inputs 2110.14430 §3.2.

Author-reported, on CIFAR-10 with ResNet-18 and 1% of the training images, attack success falls below 1% on five of six attacks, with CLB at 3.98%. Clean accuracy falls by 1.47 points on average 2110.14430 tab. 1. Fine-tuning at two learning rates lowers clean accuracy by 3.53 and 7.04 points on average, and fine-pruning leaves 65.39% attack success on Blend 2110.14430 tab. 1. With 50 images, ANP's attack success is 5.70% on Blend and below 3% on the other five attacks, and clean accuracy falls to between 85.66% and 89.54% 2110.14430 tab. 9. The paper's appendix text says ASR stays below 5% at this size, which the table does not bear out for Blend 2110.14430 app. C.3. The mask-optimisation budget matters: with 20 iterations, pruning a few percent of neurons can raise attack success again. With 100 or more iterations the authors report that this effect disappears 2110.14430 §4.4 2110.14430 fig. 4. The paper uses a perturbation budget ε of 0.4 and a trade-off α of 0.2 for ResNet-18, and ε of 0.2 for MobileNet-V2, where 0.4 did not converge 2110.14430 §4.1 2110.14430 §4.3. The released code clips the noise differently from the algorithm box, and covers fewer attacks than the paper, so reruns need that in view 2110.14430 § Paper vs code. Card: Adversarial Neuron Pruning Purifies Backdoored Deep Models.

Personalized federated learning with a pull to the global model

Ditto keeps a global model trained by an ordinary federated solver, here FedAvg. Each device also trains a personal model, which is pulled toward the global model by an L2 term weighted by λ 2012.04221 §3.1 2012.04221 §3.2. Only the global update leaves the device. With λ at zero each device trains alone, and with a very large λ it effectively uses the global model. The authors report that a λ between these extremes gives better accuracy, fairness and robustness than the robust or fair baselines they compare with 2012.04221 §1 2012.04221 §4.1 2012.04221 §4.2. Under model replacement (A3) at 50% on Fashion MNIST, the authors report mean benign accuracy of .873 for Ditto, against .275 for the global model and .131 for the fair TERM baseline 2012.04221 tab. 1. The λ rule in the paper depends on the attack strength and on each device's validation count. The released code selects λ differently, so reproduce with the code's settings in view 2012.04221 Paper vs code. Card: Ditto: Fair and Robust Federated Learning Through Personalization.

For LLMs, the security survey lists defences against backdoor and data-poisoning attacks: static analysis, STRIP, fine-pruning, data curation, query rephrasing and perplexity filtering 2402.00888 §6.1. It does not compare them. Card: Security and Privacy Challenges of Large Language Models: A Survey.

Unlearnable data for protecting one's own images

The data owner adds a small, bounded noise pattern to each image before publishing it. The bound is an L∞ norm of 8/255 for CIFAR-10, CIFAR-100 and SVHN, and 16/255 for the ImageNet subset 2101.04898 app. B. The noise is chosen by alternating steps: a helper ResNet-18 trains for a few batches, then the noise takes PGD steps that lower the helper's loss, until the helper's error on the noisy data falls below a stop value 2101.04898 §3.2 2101.04898 alg. 1. Two forms are given. Class-wise noise uses one pattern per class and is the stronger form. Sample-wise noise uses one pattern per image 2101.04898 §3.1.

Author-reported, with the full training set perturbed and a ResNet-18 target, clean test accuracy on CIFAR-10 falls from 94.95% to 16.42% with class-wise noise and to 19.93% with sample-wise noise 2101.04898 tab. 1. The same pattern holds for the other three target models, with class-wise values between 13.45% and 16.93% 2101.04898 tab. 1. The paper also reports a face-recognition case, with 16% accuracy on 50 unlearnable identities against 86% for clean ones 2101.04898 §4.5 fig. 4. The card did not review the face code, so those numbers are paper-only.

Coverage limits the protection. With 80% of the training set unlearnable and 20% clean, ResNet-18 reaches 87.23% on the mixed set, and 84.30% when trained on the clean 20% alone 2101.04898 tab. 2. Adversarial training with the 8/255 budget restores 85% on the unlearnable CIFAR-10 set 2101.04898 app. D. The imperceptibility of the noise is asserted from the bound, not measured 2101.04898 §4. Card: Unlearnable Examples: Making Personal Data Unexploitable.

Structure-robust graph models

SimP-GCN is a two-layer graph convolutional network. Each layer mixes the real graph with a kNN graph built from node features, using a learned per-node score 2011.09643 §4.1. A self-supervised loss on pairwise feature similarity is added to the training objective 2011.09643 §4.2. Under Metattack, the authors report that it improves on GCN at every perturbation rate on Cora, Citeseer and Pubmed, with a larger gap at higher rates. The text gives a gain of over 20 points on Cora at 25%, but the curves appear only in a figure 2011.09643 §5.3 fig. 2. The authors say it beats GCN-Jaccard and is comparable to Pro-GNN 2011.09643 §5.3. Card: Node Similarity Preserving Graph Convolutional Networks.

Jailbreak and prompt-injection defences

The LLM survey groups jailbreak defences into input and output filtering, SmoothLLM, LLM Guard, self-reminder prompts, goal prioritisation and Llama Guard 2402.00888 §6.1. For prompt injection it lists instruction defences, sandwich prompting, paraphrasing, re-tokenization and perplexity filtering 2402.00888 §6.1.

SmoothLLM perturbs several copies of the prompt and queries the model on each. The survey does not state the number of copies, the perturbation operations or how the answers are combined 2402.00888 §6.1. Numbers reported by the cited works, not reproduced by the survey: self-reminder lowered ChatGPT's jailbreak success from 67.21% to 19.34% for pretending and role-play prompts, and SmoothLLM reduced attack success 100x on Llama-2 and 50x on Vicuna 2402.00888 §6.1. On the attack side, MasterKey reached 21.58% average success against 7.33% for existing prompts, and PAIR needed under twenty queries on GPT-3.5 and GPT-4 2402.00888 §4.1.2. Card: Security and Privacy Challenges of Large Language Models: A Survey.

Prompt-wording robustness for LLMs

This benchmark perturbs the instruction and leaves the input sample clean 2306.04528 §2.2. It runs seven black-box text attacks at four levels. Character attacks are TextBugger and DeepWordBug, word attacks are TextFooler and BertAttack, sentence attacks append StressTest or CheckList text, and the semantic level uses fixed prompts written by GPT-4 in six languages and translated back 2306.04528 §2.2 2306.04528 app. "Semantic Level". Each attacked prompt is scored by its performance drop rate, measured against the clean prompt on the same sample set 2306.04528 §3.

Author-reported mean APDR, averaged over models and prompts, is 0.11 to 0.12 for sentence attacks, 0.17 to 0.21 for character attacks, 0.22 for the semantic set and 0.31 to 0.33 for word attacks. Lower means a smaller drop 2306.04528 tab. 2. Averaged over attacks, the mean APDR is 0.08 for Flan-UL2 and GPT-4, 0.13 for Flan-T5-large, 0.18 for ChatGPT, 0.51 for Llama2-13B-chat and 0.69 for Vicuna-13B 2306.04528 tab. 3. The two smallest values are on different sample sets, and Vicuna and Llama2 were not attacked on several datasets 2306.04528 tab. 3 2306.04528 § Pitfalls. Few-shot prompts average 0.21 and zero-shot prompts 0.33 to 0.34. The authors call few-shot prompts more robust across all datasets, but one dataset (WNLI) reverses the order for the task prompt 2306.04528 tab. 4 2306.04528 §4.1.

The authors call transfer of adversarial prompts between models marginal and inconsistent, with standard deviations often larger than the means 2306.04528 §4.4 2306.04528 tab. 6. Clean baselines differ widely between models, so a low clean score can make a drop look large 2306.04528 tab. 9. The text reports that at least 85% of sampled adversarial prompts keep the original meaning, but a human-evaluation table in the source is not part of the paper text and gives lower averages per attack. Check that figure before quoting 85% 2306.04528 §2.2 2306.04528 app.. Decoding settings are not fully stated, and the sample sizes differ by model 2306.04528 app. "Details on dataset sampling". Card: PromptRobust.

Evasion-robust AI-text detection

The stress test attacks four detector classes: soft watermarks, trained classifiers, zero-shot log-probability detectors and retrieval-based detectors 2303.11156 §1 2303.11156 §2. Its main evasion attack is recursive paraphrasing with DIPPER, where each round's output is the next round's input 2303.11156 §2.1. Author-reported, watermark TPR at 1% FPR falls from 99.8% to 80.7% after one DIPPER round on OPT-13B, and to below 20% after five rounds 2303.11156 §2.3. Other detectors fall too: DetectGPT's AUROC drops from 96.5% to 59.8% with one round of a T5 paraphraser, and the retrieval detector drops to below about 60% after five rounds 2303.11156 §2.4.

The paraphrases stay usable on the authors' own measures, but these are rough. About 70% of DIPPER outputs were rated 4 or 5 for content preservation, with 3 workers per paraphrase 2303.11156 tab. 1 2303.11156 app. B.1. The spoofing attack goes the other way. A learned proxy of the watermark's green lists lets a human write text that the watermark detector flags, cutting its AUROC from 99.8% to 1.3% 2303.11156 §3 2303.11156 app. D.1. A theorem bounds any detector's AUROC by the total variation between human and AI text 2303.11156 §4 Thm. 1. Card: Can AI-Generated Text be Reliably Detected?.

Attack detection by resynthesis

The detector segments the input and repaints it from the predicted label map. It then compares HOG descriptors of the input and of the repainted image, and a logistic regression maps the L2 distance to a label 1904.07595 §3.3 fig. 8. The authors say a single distance is simple and non-differentiable, so it is harder to attack than a learned detector 1904.07595 §3.3. Inference needs one pass through the segmenter and generator 1904.07595 §4.3. The HOG parameters are not stated 1904.07595 §3.3. Author-reported AUROC in percent, for two attacks with "pure" and "shift" targets, on Cityscapes with Bayesian SegNet, is 100, 100, 100 and 98 for this method, against 99, 98, 100 and 98 for spatial consistency 1904.07595 tab. 1. A check of the released repository found no attack or HOG code, so these results cannot be reproduced from it. Card: Detecting the Unexpected via Image Resynthesis.

White-box attacks on multimodal models

The attack adds perturbations inside an l-infinity ball to the query image, optionally also to few-shot context images. It optimises the text likelihood with APGD 2308.10741 §4 2308.10741 §5. The authors run 500 steps for the quantitative results 2308.10741 §5. Author-reported, on OpenFlamingo 9B zero-shot, untargeted COCO CIDEr falls from 84.01 to 9.59 at radius 1/255 and to 1.69 at 4/255 2308.10741 tab. 3. A targeted attack for "Please reset your password" reaches 51.66% success at 1/255 and 100% at 4/255 2308.10741 tab. 2. The paper gives no pixel scale for the radius, so the 1/255 and 4/255 figures cannot be applied to an input tensor without a check 2308.10741 §5. In the 4-shot setting, perturbing only the query leaves CIDEr only slightly higher than perturbing all images: 11.30 against 11.09 at 1/255, and 2.14 against 1.87 at 4/255 2308.10741 tab. 3. Card: On the Adversarial Robustness of Multi-Modal Foundation Models.

Proxy-set targeted attacks on multimodal embeddings

The attack replaces a single target embedding with a set of target-modal proxies. Its loss averages one minus the cosine similarity to those proxies 2509.19994 eq. 2. It adds a term that keeps the adversarial embedding near benign source-modal proxies, weighted by a factor α 2509.19994 eq. 3 2509.19994 eq. 4. The paper gives a small-α setting for generalizability and a large-α setting for undetectability 2509.19994 §5.5. The experiments use PGD under an ℓ∞ bound of 8/255, with 100 iterations 2509.19994 §5.1. The optimiser's step size and start point are not stated.

Author-reported, with no defence, average classification success is 98.31% against 93.18% for Illusion Attack. Average retrieval R@1 success is 77.72% against 46.49% 2509.19994 tab. 2 2509.19994 tab. 3. With an anomaly-detection defence, the authors report 84.17% and 61.80% for their method, against 20.04% and 14.84% for Illusion Attack 2509.19994 tab. 2 2509.19994 tab. 3. The defence is four standard outlier detectors (kNN, LOF, Isolation Forest and PCA), which the paper sets to fixed settings it does not fully define 2509.19994 §5.1. Those settings are not stated, so the defended numbers cannot be reproduced from the text. The paper names no official code 2509.19994 Paper vs code. Card: Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Models.

GPT trust benchmark with adversarial prompts

DecodingTrust runs GPT-4 and GPT-3.5 on eight trust perspectives, each under benign and adversarial system prompts or demonstrations. It uses fixed snapshots, gpt-4-0314 and gpt-3.5-turbo-0301 2306.11698 §2. Two of its tests concern robustness. The first is AdvGLUE, which it runs through three system-prompt templates 2306.11698 §5.1. Author-reported, the averaged robust accuracy with template 1 is 78.18% for GPT-4 and 67.37% for GPT-3.5, against 65.77% for a leaderboard baseline 2306.11698 tab. 5. Sentence-level attacks have the highest success rate for both models, at 31.61% for GPT-4 and 42.27% for GPT-3.5 2306.11698 tab. 6. The second is robustness to demonstrations. Counterfactual demonstrations do not mislead either model, but backdoored demonstrations do, and GPT-4 more so 2306.11698 §7. Card: DecodingTrust.

Runtime safeguards

After deployment, the trustworthiness survey lists anomaly monitoring, human–AI interaction, fail-safe mechanisms and hardware security 2110.01167 §3.4.1 2110.01167 §3.4.2 2110.01167 §3.4.3 2110.01167 §3.4.4. These address the system-level threats rather than the perturbation itself. Card: Trustworthy AI: From Principles to Practices.

Deployment failure framing

This is a framing, not a defence. The functionality paper puts "failure under adversarial attacks" in its own deployment-failure category, next to robustness issues 2206.09511 §4.2.3. It gives no decision rule for assigning cases 2206.09511 §4.2. It argues for functionality as a minimum requirement but reports no measured effect of any intervention 2206.09511 §6. Card: The Fallacy of AI Functionality.

When to use which

The surveys do not rank methods, and the numbers come from different models, datasets and threat models. The table maps constraints to the options the cards name.

Situation	Use	Why
Want to know how a model reacts to small input changes	Empirical evaluation by minimal adversarial perturbation	Named as the empirical measure 2110.01167 §2.1. No attack, budget or result is given there
Need to test a text classifier beyond its clean GLUE score	AdvGLUE, with its dev split for local checks	Built from 12 distinct attack methods and filtered by humans 2111.02840 §3.2.3 2111.02840 §3.3. Test scores need a hidden-set submission 2111.02840 §3.5
Node classification on a graph whose edges may be corrupted, and you can retrain a GCN	SimP-GCN, benchmarked against your own GCN runs	Authors report gains over GCN under Metattack at each tested rate 2011.09643 §5.3. It needs a dense cosine matrix over all node pairs 2011.09643 §4.3
Image classifier already trained with CutMix-style mixing	Try SaliencyMix against FGSM in your own setup	Authors report +1.96 over CutMix under FGSM with ResNet-50 2006.01791 tab. 4. Their ResNet-18 training time was 0.91 h against 0.89 h for CutMix on CIFAR-10 2006.01791 tab. 5
Need a query-only attack on a text classifier or entailment model, for testing	Word-substitution attack in the TextFooler style, run with your own thresholds	Needs only predictions and confidence scores 1907.11932 § Method, Threat Model. Reported results depend on the synonym and similarity settings, which the released code changes 1907.11932 § Paper vs code
Query-only attack on a text classifier, where replacements must fit the sentence context	BAE-style masked-LM replacement and insertion, with its similarity and part-of-speech filters	Authors report stronger attacks than TextFooler in most settings. Replacement-only is weaker than TextFooler on BERT 2004.01970 tab. 1 2004.01970 tab. 2. Each position needs one masked-LM pass 2004.01970 alg. 1
Need small input changes that flip an image classifier's label, to probe its blind spots	Minimal-perturbation search with box-constrained L-BFGS and a label check, as in the original paper	Gives approximately minimal perturbations, and the paper reports transfer between models 1312.6199 §4.1 1312.6199 tab. 2. The search's step and stop rules are not stated, so verify each result by its label
Need a bound on how much a network can amplify input changes	Product of per-layer Lipschitz bounds, from weight norms and the convolution formula	Upper bounds only. A small bound guarantees that no adversarial examples exist, and a large one does not show that they do 1312.6199 §4.3. The convolution formula needs a numerical check 1312.6199 eq. 1
Training a robust classifier with PGD adversarial training, and you need a rule for how strong the inner attack should be at each epoch	Dynamic FOSC threshold schedule, with c_max and T′ set by you and checked on your own model	Author-reported gains over standard PGD on CIFAR-10 and MNIST 2112.08304 tab. 1. Clean accuracy can drop in the WideResNet setting 2112.08304 tab. 3. The stop rule saves no compute in the released code 2112.08304 § Pitfalls
Need a guarantee over a bounded perturbation	Certified lower bounds from verification	Named as the certified measure 2110.01167 §2.1. The survey gives no method, cost or example 2110.01167 §3.3 tab. 1
LLM behind an API with no weight access	Input and output filters, self-reminder prompts, or SmoothLLM-style perturbation	Filters and prompts need no retraining 2402.00888 §6.1. SmoothLLM queries the model once per perturbed copy 2402.00888 §6.1
Training data comes from sources you do not control	Data provenance, anomaly detection and poisoning defences	Listed as data-stage and algorithm-stage measures 2110.01167 §3.1.1 2110.01167 §3.1.2 2110.01167 §3.2.1. No defence is compared
Federated training where some devices may send corrupted labels or updates, and each device's data differs from the others	Ditto, with a robust server aggregator such as clipping	Authors report Ditto with clipping best in five of six FEMNIST columns, while clipping alone falls to .061 under model replacement at 20% 2012.04221 tab. 3. Each device keeps a personal model and tunes λ on its own validation data, and the paper gives no cost figures 2012.04221 §3.2 2012.04221 Pitfalls
Downloaded model with a suspected backdoor, no trigger known, a small clean set, and no budget for full retraining	Adversarial neuron pruning with a mask threshold, checked on your own model	One pruning pass without fine-tuning. Authors report ASR below 1% on five of six CIFAR-10 attacks 2110.14430 tab. 1. The threshold band and the pruned fraction vary by architecture 2110.14430 §4.3 2110.14430 fig. 3, and the released code covers only some attacks 2110.14430 § Paper vs code
Need vocabulary, threat models and a literature map for poisoning and backdoors before choosing a method	The dataset-security survey as a reading map, not a method source	It separates training-only poisoning from backdoors and lists open problems per topic 2012.10544 §1 2012.10544 §2.8 2012.10544 §3.4. It reports no results of its own 2012.10544 §5
You publish images and want them to be of little use for training, and you can change them before upload	Class-wise error-minimizing noise, generated against a ResNet-18 source model	Lowers clean accuracy strongly when all data carries it 2101.04898 tab. 1. Protection fades when only part of the data is perturbed 2101.04898 tab. 2 and adversarial training recovers much of the accuracy 2101.04898 app. D
Segmentation pipeline that needs a cheap adversarial-input flag, with a segmenter and a generator already available	Resynthesis-distance detector with HOG features and logistic regression	Single forward pass and a non-differentiable score, per the authors 1904.07595 §3.3 1904.07595 §4.3. Their attack results have no released code and are on two attacks only 1904.07595 tab. 1
Open vision-language model that processes images from third parties	Test with bounded white-box perturbations, and treat outputs from unverified images with care	Author-reported drops in caption quality at 1/255 and 4/255 2308.10741 tab. 3. All reported results are attacks, so the paper gives no defence numbers to compare 2308.10741 tab. 2 2308.10741 tab. 3
Testing whether a multimodal retrieval index can be poisoned by targeted images that evade outlier checks	Proxy-set attack with its α setting swept, run against your own detectors	Author-reported gains over Illusion Attack under the same defence 2509.19994 tab. 3. Detector settings are not stated, so the defended numbers need a rerun 2509.19994 §5.1
Testing a hosted GPT model's trust, including behaviour under adversarial prompts	Rerun a DecodingTrust-style suite on the exact model you deploy	The paper's results are for two dated snapshots, so they are not comparable to other models without a rerun 2306.11698 §2
Model receives malformed or spoofed inputs in production	Input checks, anomaly monitoring and fail-safe mechanisms	Named as system-level threats and deployment measures 2110.01167 §2.1 2110.01167 §3.4.1 2110.01167 §3.4.3
Relying on an AI-text detector that may face paraphrasing	Assume its accuracy can drop under recursive paraphrasing, and test with paraphrase rounds	Watermark and retrieval detectors lost much accuracy in the paper's settings 2303.11156 §2.3 2303.11156 §2.4
Robustness gains are costing clean accuracy	Accept an explicit trade-off; do not optimize one criterion alone	The survey says robustness can reduce overall accuracy and that trustworthiness cannot be reached by optimizing separate criteria one at a time 2110.01167 §2.2 2110.01167 §4.1.2
Training images come from the web, and you want to test whether a few correctly labelled planted images could make one target misclassified, with no access to the victim	Clean-label convex polytope attack, run against your own substitute models as a stress test	Black-box in the paper's setup, and the authors report transfer at 1% poisoning 1905.05897 §2 1905.05897 §4.1. Single-layer poisons almost never transfer to end-to-end victims, so use the multi-layer variant there 1905.05897 §4.3. Only the convex polytope routine is released 1905.05897 § Paper vs code
Need to know how much an LLM application's accuracy depends on small wording errors in its fixed instruction	PromptRobust-style text attacks on the prompt, scored by drop from the clean prompt on your own samples	Attacks the prompt and leaves inputs unchanged 2306.04528 §2.2. Results depend on the sample and decoder, and the paper's clean baselines differ by model 2306.04528 tab. 9 2306.04528 § Pitfalls. Compare models only with their clean scores beside them
Comparing methods on cost or accuracy gain across cards	Compare only within one card	Each number comes from its own setup. The graph gains are in a figure, the image attack strength is unstated, and the LLM numbers are cited from other papers 2011.09643 §5.3 2006.01791 §4.4 2402.00888 §6.1

Implementation sketch

No shared core. The variants act at different points, so there is no common algorithm to sketch. Adversarial training changes the training loop 2110.01167 §3.2.1. The dynamic schedule adds a per-example stop to the PGD loop and an epoch threshold that falls over training 2112.08304 alg. 1 2112.08304 §4.1. The original minimal-perturbation search wraps an L-BFGS solve in a penalty line search 1312.6199 §4.1. SaliencyMix changes how each training batch is built and how its labels are mixed 2006.01791 §3.2. SimP-GCN changes the layer's propagation matrix 2011.09643 §4.1. The data-protection noise runs its own loop: a helper model trains for a few batches, then the noise takes PGD steps on the same images 2101.04898 §3.2. SmoothLLM wraps a deployed model with several queries 2402.00888 §6.1. The paraphrase attack is a loop over rounds of one model call 2303.11156 §2.1. The proxy-set attack optimises one image against several target and source proxies with the same descent loop, and its ℓ∞ projection is the same as in PGD 2509.19994 eq. 4 2509.19994 §5.1. Federated defences add a round structure: the server sends the global model, each device takes global and personal steps, and the server averages the global updates. Personal models stay on the device 2012.04221 alg. 1 2012.04221 §3.2. A sketch of that round is in the Ditto card. The neuron-pruning repair runs a mask loop: per mini-batch, one ascent step on the noise, then a gradient step on the masks, then a clip to [0, 1]. Neurons under a threshold are cut at the end 2110.14430 alg. 1. The word-substitution attack ranks the input's words, then tries replacements in that order until one flips the label 1907.11932 alg. 1. BAE uses the same ranking and stop rule, but takes its candidates from a masked language model's top fillers instead of a synonym source 2004.01970 alg. 1. The clean-label poisoning attack fits one set of mixing coefficients per substitute model, then runs a fixed number of Adam steps on the poison images. The released code uses a fixed step count rather than the paper's convergence loop 1905.05897 alg. 1 1905.05897 § Paper vs code. The prompt benchmark runs a greedy word-importance search for four of its attacks and scores every candidate for CheckList and StressTest 2306.04528 § Paper vs code. Each card has its own pseudocode and notes on what the paper leaves open: see the SaliencyMix card, the graph paper for the layer, the LLM survey for the SmoothLLM procedure, and the detection stress test for the paraphrase loop. Do not build a defence from this page alone.

Contradictions

Ditto's numbers across tables. Ditto's clean FEMNIST accuracy is .834 in Table 1 and .836 in Table 2, and its global A3 20% value is .314 in Table 1 against .364 in the appendix 2012.04221 tab. 1 2012.04221 tab. 2 2012.04221 app. D.4. The paper does not explain these gaps, and the Table 2 λ is not stated.
Target-set sizes across tables. The proxy-set paper gives ImageBind's no-defence baseline at (N_s, N_c) = (20, 10) as 95.35 in one ablation table, while its main classification table gives 77.54 for the same model, dataset and defence 2509.19994 tab. 17 2509.19994 tab. 2. The paper does not explain the gap 2509.19994 tab. 17.
Adversarial training and test error. The original paper reports lower test error for adversarial training than for weight decay alone, below 1.2% against 1.6% on a 100-100-10 network 1312.6199 §4.2. The trustworthiness survey says adversarial training can lower test accuracy 2110.01167 §2.2. The paper's result is a single preliminary run with no variance, and the survey gives no numbers, so the two are not reconciled.
Adversarial training and generalization. The survey says adversarial training is in tension with generalization and can lower test accuracy 2110.01167 §2.2. It also says adversarial robustness can improve generalization while reducing overall accuracy 2110.01167 §4.1.2. Both statements come from the same survey and are not reconciled there.
Neuron-pruning repair at the smallest clean set. The appendix text says ANP keeps ASR below 5% with 0.1% of the clean data, but the same paper's table gives 5.70 ± 8.87 for Blend 2110.14430 app. C.3 2110.14430 tab. 9. The paper does not reconcile the two.
Formal verification. The lifecycle table lists formal verification under development, but the body section on it is commented out in the source 2110.01167 §3.3 tab. 1.
Same setting, different tables. The multimodal attack paper reports zero-shot untargeted COCO CIDEr at 1/255 and 500 steps as 15.72 on 100 images in one table 2308.10741 tab. 1 and as 9.59 on 1000 images in another 2308.10741 tab. 3. The paper does not explain the gap 2308.10741 tab. 1 2308.10741 tab. 3.
AdvGLUE scope and scores. The Adversarial GLUE card lists five GLUE tasks and reports averages of 30.29 to 60.86 for ten models 2111.02840 §3.1 2111.02840 tab. 4. DecodingTrust lists six tasks, adding MNLI-mm, and reports 78.18 and 67.37 for prompted GPT-4 and GPT-3.5 2306.11698 §5.1 2306.11698 tab. 5. The two sets of numbers come from different model types, prompts and metrics, so do not compare them.
Attack setting in the LLM survey. Its text describes attacks that perturb training samples, but the formula and the description that follows use perturbations added to inputs at test time 2402.00888 §4.2. The survey does not settle which setting applies. Read the primary sources before reusing an attack.
Transfer success wording. The abstract of the clean-label poisoning paper reports over 50% transfer success at 1% poisoning 1905.05897 abstract. Its §4.1 text puts the convex polytope attack at or near 0.5 for most victims 1905.05897 §4.1. Only the figure has per-victim values, and the text prints none, so the two statements cannot be checked against each other.
Headline drop in the prompt benchmark. Its introduction gives a 39% average drop for word-level attacks, §4.1 gives 33%, and Table 2 gives 0.31 and 0.33 for the two word attacks 2306.04528 §1 2306.04528 §4.1 2306.04528 tab. 2. This page uses the table values.

Papers

Intriguing properties of neural networks: the original adversarial-example paper, with a minimal-perturbation search, cross-model transfer results and a layer-wise Lipschitz bound. Its unit-analysis part is not covered here.
Trustworthy AI: From Principles to Practices: a survey that places adversarial robustness among eight trust aspects and in the algorithm-design stage of the AI lifecycle.
Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Models: a targeted attack on multimodal embeddings that uses proxy sets and reports success against outlier detectors.
SaliencyMix: A Saliency Guided Data Augmentation Strategy for Better Regularization: an image augmentation that reports one FGSM robustness result next to its accuracy gains.
Node Similarity Preserving Graph Convolutional Networks: SimP-GCN, a graph network with reported robustness gains under Metattack on assortative graphs.
Unlearnable Examples: Making Personal Data Unexploitable: error-minimizing noise that makes published images unhelpful for training, with partial-coverage and adversarial-training results.
Adversarial GLUE: a benchmark of filtered adversarial text for five GLUE tasks, with author-reported scores for ten models.
On the Convergence and Robustness of Adversarial Training: a dynamic adversarial-training schedule that stops inner PGD attacks by a stationarity score, with author-reported CIFAR-10 gains over standard PGD training.
Is BERT Really Robust?: a black-box word-substitution attack on text classifiers and entailment models, with author-reported accuracy drops and an adversarial-training run.
BAE: BERT-based Adversarial Examples for Text Classification: a black-box attack that fills word replacements and insertions from a masked language model, with author-reported accuracy drops against TextFooler.
DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models: an eight-perspective trust benchmark for GPT-4 and GPT-3.5, with AdvGLUE and adversarial-demonstration results.
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses: a survey of training-only poisoning, backdoors and their defences, with a taxonomy and open problems and no experiments.
Adversarial Neuron Pruning Purifies Backdoored Deep Models: a backdoor repair that masks and prunes neurons after training, with author-reported attack success on CIFAR-10.
Security and Privacy Challenges of Large Language Models: A Survey: a taxonomy of prompt injection, jailbreaks, backdoors and poisoning, with defences and numbers quoted from cited works.
The Fallacy of AI Functionality: a position paper that treats failure under adversarial attack as one deployment-failure category.
Can AI-Generated Text be Reliably Detected?: a stress test of AI-text detectors under recursive paraphrasing and spoofing, with a theoretical bound on detector AUROC.
On the Adversarial Robustness of Multi-Modal Foundation Models: white-box perturbation attacks on OpenFlamingo 9B, with targeted and untargeted results.
Detecting the Unexpected via Image Resynthesis: an anomaly detector whose resynthesis also flags adversarial inputs, with author-reported AUROC.
Ditto: Fair and Robust Federated Learning Through Personalization: a personal model per device pulled toward the global model, with author-reported robustness against label, random-update and model-replacement attacks.
Transferable Clean-Label Poisoning Attacks on Deep Neural Nets: a clean-label poisoning attack that transfers from substitute networks to unseen victims, with author-reported transfer success at 1% poisoning.
PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts: seven text attacks on prompts, scored by performance drop rate across 13 datasets and six LLMs.

Source and license

Compiled from the papers listed on this page, all published under CC BY, CC BY-SA or CC0, with citations. See each paper's page for its authors and license.