Mitigating Adversarial Effects Through Randomization

2017/11/06 by Cihang Xie, Jianyu Wang, Xie, Cihang +7 · 22 citations
Computer Science · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.1711.01991

openalex publication_date 2017/11/06 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.

Citations

• Densely Connected Convolutional Networks
• Unsupervised learning of object semantic parts from internal states of CNNs by population encoding
• Adversarial Machine Learning at Scale
• Adversarial Examples for Semantic Image Segmentation
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Deep Residual Learning for Image Recognition

Cited by

• Efficient and Robust Video Defense Framework against 3D-field Personalized Talking Face
• Autoencoder-based Denoising Defense against Adversarial Attacks on Object Detection
• Studying Various Activation Functions and Non-IID Data for Machine Learning Model Robustness
• Medusa: Cross-Modal Transferable Adversarial Attacks on Multimodal Medical Retrieval-Augmented Generation
• TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models
• Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling
• Towards Strong Certified Defense with Universal Asymmetric Randomization
• CoDefend: Cross-Modal Collaborative Defense via Diffusion Purification and Prompt Optimization
• Uncolorable Examples: Preventing Unauthorized AI Colorization via Perception-Aware Chroma-Restrictive Perturbation
• ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search
• Concept-SAE: Active Causal Probing of Visual Model Behavior
• SyncBreaker:Stage-Aware Multimodal Adversarial Attacks on Audio-Driven Talking Head Generation
• Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition
• ANNIE: Be Careful of Your Robots
• ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformers
• Exploit Clues from Views: Self-Supervised and Regularized Learning for Multiview Object Recognition
• Non-Determinism in Neural Networks for Adversarial Robustness
• Boosting Adversarial Transferability via Residual Perturbation Attack
• Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training
• Adversarial-Guided Diffusion for Multimodal LLM Attacks
• RCR-AF: Enhancing Model Generalization via Rademacher Complexity Reduction Activation Function
• Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removal

Related

• Defending against Whitebox Adversarial Attacks via Randomized Discretization
• On the Security of Randomized Defenses Against Adversarial Samples
• Output Randomization: A Novel Defense for both White-box and Black-box Adversarial Models
• Randomized Adversarial Training via Taylor Expansion
• Threat Model-Agnostic Adversarial Defense using Diffusion Models