# Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks

arXiv: https://arxiv.org/abs/1709.03423 · HTML: https://mlsanity.com/paper/1709.03423/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Sep 2017.

## Built on by (most cited first, 30 of 31)

- [Fixing Data Augmentation to Improve Adversarial Robustness](https://mlsanity.com/paper/2103.01946/) (2021)
- [Data Augmentation Can Improve Robustness](https://mlsanity.com/paper/2111.05328/) (2021)
- [Relating Adversarially Robust Generalization to Flat Minima](https://mlsanity.com/paper/2104.04448/) (2021)
- [Deep Ensembling with No Overhead for either Training or Testing: The All-Round Blessings of Dynamic Sparsity](https://mlsanity.com/paper/2106.14568/) (2021)
- [Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectives](https://mlsanity.com/paper/2307.16851/) (2023)
- [Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attacks](https://mlsanity.com/paper/2106.06235/) (2021)
- [Security and Privacy for Artificial Intelligence: Opportunities and Challenges](https://mlsanity.com/paper/2102.04661/) (2021)
- [Spiking Convolutional Neural Networks for Text Classification](https://mlsanity.com/paper/2406.19230/) (2024)
- [Neural Ensemble Search via Bayesian Sampling](https://mlsanity.com/paper/2109.02533/) (2021)
- [To Stay or Not to Stay in the Pre-train Basin: Insights on Ensembling in Transfer Learning](https://mlsanity.com/paper/2303.03374/) (2023)
- [2-in-1 Accelerator: Enabling Random Precision Switch for Winning Both Adversarial Robustness and Efficiency](https://mlsanity.com/paper/2109.05223/) (2021)
- [Sequential Bayesian Neural Subnetwork Ensembles](https://mlsanity.com/paper/2206.00794/) (2022)
- [Towards Adversarial Robustness of Model-Level Mixture-of-Experts Architectures for Semantic Segmentation](https://mlsanity.com/paper/2412.11608/) (2024)
- [Resisting Adversarial Attacks in Deep Neural Networks using Diverse Decision Boundaries](https://mlsanity.com/paper/2208.08697/) (2022)
- [Tensor Normalization and Full Distribution Training](https://mlsanity.com/paper/2109.02345/) (2021)
- [Alignment is not sufficient to prevent large language models from generating harmful information: A psychoanalytic perspective](https://mlsanity.com/paper/2311.08487/) (2023)
- [Advancing Robustness in Deep Reinforcement Learning with an Ensemble Defense Approach](https://mlsanity.com/paper/2507.17070/) (2025)
- [Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness](https://mlsanity.com/paper/2106.02867/) (2021)
- [Saliency Diversified Deep Ensemble for Robustness to Adversaries](https://mlsanity.com/paper/2112.03615/) (2021)
- [Memory Defense: More Robust Classification via a Memory-Masking Autoencoder](https://mlsanity.com/paper/2202.02595/) (2022)
- [Robust Confinement State Classification with Uncertainty Quantification through Ensembled Data-Driven Methods](https://mlsanity.com/paper/2502.17397/) (2025)
- [Resilience from Diversity: Population-based approach to harden models against adversarial attacks](https://mlsanity.com/paper/2111.10272/) (2021)
- [Divided We Fall: Defending Against Adversarial Attacks via Soft-Gated Fractional Mixture-of-Experts with Randomized Adversarial Training](https://mlsanity.com/paper/2512.20821/) (2025)
- [Defending Adversarial Examples by Negative Correlation Ensemble](https://mlsanity.com/paper/2206.10334/) (2022)
- [Butterfly Effect Attack: Tiny and Seemingly Unrelated Perturbations for Object Detection](https://mlsanity.com/paper/2211.07483/) (2022)
- [Reducing Adversarial Training Cost with Gradient Approximation](https://mlsanity.com/paper/2309.09464/) (2023)
- [Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training](https://mlsanity.com/paper/2312.00105/) (2023)
- [May the Noise be with you: Adversarial Training without Adversarial Examples](https://mlsanity.com/paper/2312.08877/) (2023)
- [Lightweight Defense Against Adversarial Attacks in Time Series Classification](https://mlsanity.com/paper/2505.02073/) (2025)
- [QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits](https://mlsanity.com/paper/2604.10933/) (2026)

## Abstract (arXiv)

Deep learning has become the state of the art approach in many machine learning problems such as classification. It has recently been shown that deep learning is highly vulnerable to adversarial perturbations. Taking the camera systems of self-driving cars as an example, small adversarial perturbations can cause the system to make errors in important tasks, such as classifying traffic signs or detecting pedestrians. Hence, in order to use deep learning without safety concerns a proper defense strategy is required. We propose to use ensemble methods as a defense strategy against adversarial perturbations. We find that an attack leading one model to misclassify does not imply the same for other networks performing the same task. This makes ensemble methods an attractive defense strategy against adversarial attacks. We empirically show for the MNIST and the CIFAR-10 data sets that ensemble methods not only improve the accuracy of neural networks on test data but also increase their robustness against adversarial perturbations.