# Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

arXiv: https://arxiv.org/abs/1706.04701 · HTML: https://mlsanity.com/paper/1706.04701/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jun 2017.

## Built on by (most cited first, 30 of 32)

- [Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them](https://mlsanity.com/paper/2107.11630/) (2021)
- [On the benefits of knowledge distillation for adversarial robustness](https://mlsanity.com/paper/2203.07159/) (2022)
- [Security and Privacy for Artificial Intelligence: Opportunities and Challenges](https://mlsanity.com/paper/2102.04661/) (2021)
- [What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction](https://mlsanity.com/paper/2201.09650/) (2022)
- [Enhancing Adversarial Robustness for Deep Metric Learning](https://mlsanity.com/paper/2203.01439/) (2022)
- [On the robustness of randomized classifiers to adversarial examples](https://mlsanity.com/paper/2102.10875/) (2021)
- [How many perturbations break this model? Evaluating robustness beyond adversarial accuracy](https://mlsanity.com/paper/2207.04129/) (2022)
- [Differential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detection](https://mlsanity.com/paper/2307.05422/) (2023)
- [Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model](https://mlsanity.com/paper/2105.02803/) (2021)
- [The Security of Deep Learning Defences for Medical Imaging](https://mlsanity.com/paper/2201.08661/) (2022)
- [Refutation of Shapley Values for XAI -- Additional Evidence](https://mlsanity.com/paper/2310.00416/) (2023)
- [Tensor Normalization and Full Distribution Training](https://mlsanity.com/paper/2109.02345/) (2021)
- [Frequency Centric Defense Mechanisms against Adversarial Examples](https://mlsanity.com/paper/2110.13935/) (2021)
- [Hindering Adversarial Attacks with Implicit Neural Representations](https://mlsanity.com/paper/2210.13982/) (2022)
- [BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability](https://mlsanity.com/paper/2105.00495/) (2021)
- [DeepMoM: Robust Deep Learning With Median-of-Means](https://mlsanity.com/paper/2105.14035/) (2021)
- [Rethinking Machine Learning Robustness via its Link with the Out-of-Distribution Problem](https://mlsanity.com/paper/2202.08944/) (2022)
- [Sardino: Ultra-Fast Dynamic Ensemble for Secure Visual Sensing at Mobile Edge](https://mlsanity.com/paper/2204.08189/) (2022)
- [Morphence-2.0: Evasion-Resilient Moving Target Defense Powered by Out-of-Distribution Detection](https://mlsanity.com/paper/2206.07321/) (2022)
- [Data-free Defense of Black Box Models Against Adversarial Attacks](https://mlsanity.com/paper/2211.01579/) (2022)
- [Computational Asymmetries in Robust Classification](https://mlsanity.com/paper/2306.14326/) (2023)
- [What Really is a Member? Discrediting Membership Inference via Poisoning](https://mlsanity.com/paper/2506.06003/) (2025)
- [Multi-Layer Confidence Scoring for Detection of Out-of-Distribution Samples, Adversarial Attacks, and In-Distribution Misclassifications](https://mlsanity.com/paper/2512.19472/) (2025)
- [Ares: A System-Oriented Wargame Framework for Adversarial ML](https://mlsanity.com/paper/2210.12952/) (2022)
- [Improved Robustness Against Adaptive Attacks With Ensembles and Error-Correcting Output Codes](https://mlsanity.com/paper/2303.02322/) (2023)
- [Detection of Adversarial Physical Attacks in Time-Series Image Data](https://mlsanity.com/paper/2304.13919/) (2023)
- [Evaluating the Robustness of Off-Road Autonomous Driving Segmentation against Adversarial Attacks: A Dataset-Centric analysis](https://mlsanity.com/paper/2402.02154/) (2024)
- [On the Importance of Encrypting Deep Features](https://mlsanity.com/paper/2108.07147/) (2021)
- [A Perturbation Resistant Transformation and Classification System for Deep Neural Networks](https://mlsanity.com/paper/2208.11839/) (2022)
- [Robust Few-shot Learning Without Using any Adversarial Samples](https://mlsanity.com/paper/2211.01598/) (2022)

## Abstract (arXiv)

Ongoing research has proposed several methods to defend neural networks against adversarial examples, many of which researchers have shown to be ineffective. We ask whether a strong defense can be created by combining multiple (possibly weak) defenses. To answer this question, we study three defenses that follow this approach. Two of these are recently proposed defenses that intentionally combine components designed to work well together. A third defense combines three independent defenses. For all the components of these defenses and the combined defenses themselves, we show that an adaptive adversary can create adversarial examples successfully with low distortion. Thus, our work implies that ensemble of weak defenses is not sufficient to provide strong defense against adversarial examples.