mlsanityData to 7 Oct 2026

Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

arXiv 1706.04701 ↗First posted 15 Jun 2017cs.LGcited by 32

Not on the map. Why?

Abstract (arXiv)

Ongoing research has proposed several methods to defend neural networks against adversarial examples, many of which researchers have shown to be ineffective. We ask whether a strong defense can be created by combining multiple (possibly weak) defenses. To answer this question, we study three defenses that follow this approach. Two of these are recently proposed defenses that intentionally combine components designed to work well together. A third defense combines three independent defenses. For all the components of these defenses and the combined defenses themselves, we show that an adaptive adversary can create adversarial examples successfully with low distortion. Thus, our work implies that ensemble of weak defenses is not sufficient to provide strong defense against adversarial examples.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). First posted on arXiv 15 Jun 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 9; 2022: 14; 2023: 5; 2024: 1; 2025: 2; 2026: 1.

32 papers.

Sort:

By area:

  1. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
  2. 2022On the benefits of knowledge distillation for adversarial robustnesscited by 17
  3. 2021Security and Privacy for Artificial Intelligence: Opportunities and Challengescited by 16
  4. 2022What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradictioncited by 10
  5. 2022Enhancing Adversarial Robustness for Deep Metric Learningcited by 10
  6. 2021On the robustness of randomized classifiers to adversarial examplescited by 9
  7. 2022How many perturbations break this model? Evaluating robustness beyond adversarial accuracycited by 9
  8. 2023Differential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detectioncited by 6
  9. 2021Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Modelcited by 4
  10. 2022The Security of Deep Learning Defences for Medical Imagingcited by 4
  11. 2023Refutation of Shapley Values for XAI -- Additional Evidencecited by 4
  12. 2021Tensor Normalization and Full Distribution Trainingcited by 3
20 more
  1. 2021Frequency Centric Defense Mechanisms against Adversarial Examplescited by 3
  2. 2022Hindering Adversarial Attacks with Implicit Neural Representationscited by 3
  3. 2021BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidabilitycited by 2
  4. 2021DeepMoM: Robust Deep Learning With Median-of-Meanscited by 2
  5. 2022Rethinking Machine Learning Robustness via its Link with the Out-of-Distribution Problemcited by 2
  6. 2022Sardino: Ultra-Fast Dynamic Ensemble for Secure Visual Sensing at Mobile Edgecited by 2
  7. 2022Morphence-2.0: Evasion-Resilient Moving Target Defense Powered by Out-of-Distribution Detectioncited by 2
  8. 2022Data-free Defense of Black Box Models Against Adversarial Attackscited by 2
  9. 2023Computational Asymmetries in Robust Classificationcited by 2
  10. 2025What Really is a Member? Discrediting Membership Inference via Poisoningcited by 2
  11. 2025Multi-Layer Confidence Scoring for Detection of Out-of-Distribution Samples, Adversarial Attacks, and In-Distribution Misclassificationscited by 2
  12. 2022Ares: A System-Oriented Wargame Framework for Adversarial MLcited by 1
  13. 2023Improved Robustness Against Adaptive Attacks With Ensembles and Error-Correcting Output Codescited by 1
  14. 2023Detection of Adversarial Physical Attacks in Time-Series Image Datacited by 1
  15. 2024Evaluating the Robustness of Off-Road Autonomous Driving Segmentation against Adversarial Attacks: A Dataset-Centric analysiscited by 1
  16. 2021On the Importance of Encrypting Deep Featurescited by 0
  17. 2022A Perturbation Resistant Transformation and Classification System for Deep Neural Networkscited by 0
  18. 2022Robust Few-shot Learning Without Using any Adversarial Samplescited by 0
  19. 2022Adversarial Detection by Approximation of Ensemble Boundarycited by 0
  20. 2026A Convolutional Layer Activation Dimensionality Reduction for Out-of-Distribution and Adversarial Attack Detection Methodscited by 0