# Enhancing Robustness of Machine Learning Systems via Data Transformations

arXiv: https://arxiv.org/abs/1704.02654 · HTML: https://mlsanity.com/paper/1704.02654/

## Key facts

- Cited by 38 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Apr 2017.

## Built on by (most cited first, 30 of 38)

- [Baseline Defenses for Adversarial Attacks Against Aligned Language Models](https://mlsanity.com/paper/2309.00614/) (2023)
- [Revisiting the Adversarial Robustness of Vision Language Models: a Multimodal Perspective](https://mlsanity.com/paper/2404.19287/) (2024)
- ["Adversarial Examples" for Proof-of-Learning](https://mlsanity.com/paper/2108.09454/) (2021)
- [False Claims against Model Ownership Resolution](https://mlsanity.com/paper/2304.06607/) (2023)
- [Espresso: Robust Concept Filtering in Text-to-Image Models](https://mlsanity.com/paper/2404.19227/) (2024)
- [NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/2106.11865/) (2021)
- [Projected Randomized Smoothing for Certified Adversarial Robustness](https://mlsanity.com/paper/2309.13794/) (2023)
- [Morphence: Moving Target Defense Against Adversarial Examples](https://mlsanity.com/paper/2108.13952/) (2021)
- [A.I. Robustness: a Human-Centered Perspective on Technological Challenges and Opportunities](https://mlsanity.com/paper/2210.08906/) (2022)
- [Efficient Learning of Interpretable Classification Rules](https://mlsanity.com/paper/2205.06936/) (2022)
- [AutoJoin: Efficient Adversarial Training against Gradient-Free Perturbations for Robust Maneuvering via Denoising Autoencoder and Joint Learning](https://mlsanity.com/paper/2205.10933/) (2022)
- [Boosting Robustness Verification of Semantic Feature Neighborhoods](https://mlsanity.com/paper/2209.05446/) (2022)
- [Unraveling the Key of Machine Learning-based Android Malware Detection](https://mlsanity.com/paper/2402.02953/) (2024)
- [Towards Trustworthy Machine Learning in Production: An Overview of the Robustness in MLOps Approach](https://mlsanity.com/paper/2410.21346/) (2024)
- [Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks](https://mlsanity.com/paper/2101.01543/) (2021)
- [Sparta: Spatially Attentive and Adversarially Robust Activation](https://mlsanity.com/paper/2105.08269/) (2021)
- [Rethinking Machine Learning Robustness via its Link with the Out-of-Distribution Problem](https://mlsanity.com/paper/2202.08944/) (2022)
- [Morphence-2.0: Evasion-Resilient Moving Target Defense Powered by Out-of-Distribution Detection](https://mlsanity.com/paper/2206.07321/) (2022)
- [Efficient Search of Comprehensively Robust Neural Architectures via Multi-fidelity Evaluation](https://mlsanity.com/paper/2305.07308/) (2023)
- [Whispers in the Machine: Confidentiality in Agentic Systems](https://mlsanity.com/paper/2402.06922/) (2024)
- [Robust lEarned Shrinkage-Thresholding (REST): Robust unrolling for sparse recover](https://mlsanity.com/paper/2110.10391/) (2021)
- [Data Synthesis for Testing Black-Box Machine Learning Models](https://mlsanity.com/paper/2111.02161/) (2021)
- [Spatial-Frequency Discriminability for Revealing Adversarial Perturbations](https://mlsanity.com/paper/2305.10856/) (2023)
- [Robust width: A lightweight and certifiable adversarial defense](https://mlsanity.com/paper/2405.15971/) (2024)
- [MASKDROID: Robust Android Malware Detection with Masked Graph Representations](https://mlsanity.com/paper/2409.19594/) (2024)
- [Trans-defense: Transformer-based Denoiser for Adversarial Defense with Spatial-Frequency Domain Representation](https://mlsanity.com/paper/2510.27245/) (2025)
- [DAFAR: Defending against Adversaries by Feedback-Autoencoder Reconstruction](https://mlsanity.com/paper/2103.06487/) (2021)
- [Mitigating Gradient-based Adversarial Attacks via Denoising and Compression](https://mlsanity.com/paper/2104.01494/) (2021)
- [On the Robustness and Generalization of Deep Learning Driven Full Waveform Inversion](https://mlsanity.com/paper/2111.14220/) (2021)
- [Survey of Trustworthy AI: A Meta Decision of AI](https://mlsanity.com/paper/2306.00380/) (2023)

## Abstract (arXiv)

We propose the use of data transformations as a defense against evasion attacks on ML classifiers. We present and investigate strategies for incorporating a variety of data transformations including dimensionality reduction via Principal Component Analysis and data `anti-whitening' to enhance the resilience of machine learning, targeting both the classification and the training phase. We empirically evaluate and demonstrate the feasibility of linear transformations of data as a defense mechanism against evasion attacks using multiple real-world datasets. Our key findings are that the defense is (i) effective against the best known evasion attacks from the literature, resulting in a two-fold increase in the resources required by a white-box adversary with knowledge of the defense for a successful attack, (ii) applicable across a range of ML classifiers, including Support Vector Machines and Deep Neural Networks, and (iii) generalizable to multiple application domains, including image classification and human activity classification.