Data to 7 Oct 2026

Countering Adversarial Images using Input Transformations

arXiv 1711.00117 ↗First posted 31 Oct 2017cs.CVcited by 517

Not on the map. Why?

Cited by 21 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

This paper investigates strategies that defend against adversarial-example attacks on image-classification systems by transforming the inputs before feeding them to the system. Specifically, we study applying image transformations such as bit-depth reduction, JPEG compression, total variance minimization, and image quilting before feeding the image to a convolutional network classifier. Our experiments on ImageNet show that total variance minimization and image quilting are very effective defenses in practice, in particular, when the network is trained on transformed images. The strength of those defenses lies in their non-differentiable nature and their inherent randomness, which makes it difficult for an adversary to circumvent the defenses. Our best defense eliminates 60% of strong gray-box and 90% of strong black-box attacks by a variety of major attack methods

Key facts. Cited by 517 papers in the map (data through 7 Oct 2026). First posted on arXiv 31 Oct 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 141; 2022: 91; 2023: 91; 2024: 76; 2025: 76; 2026: 42.

517 papers.

Sort:

By area:

2023A Comprehensive Survey on Test-Time Adaptation under Distribution Shiftscited by 353
2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
2023Certifying LLM Safety against Adversarial Promptingcited by 248
2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examplescited by 163
2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
2021Adversarial purification with Score-based generative modelscited by 132
2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2021On the Convergence and Robustness of Adversarial Trainingcited by 127

38 more

2023End-to-End Diffusion Latent Optimization Improves Classifier Guidancecited by 107
2022Guided Diffusion Model for Adversarial Purificationcited by 90
2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
2023Content-based Unrestricted Adversarial Attackcited by 73
2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
2021Person Re-identification Method Based on Color Attack and Joint Defencecited by 56
2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
2021Consistency Regularization for Adversarial Robustnesscited by 42
2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
2023Adversarial Prompt Tuning for Vision-Language Modelscited by 42
2025Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignmentcited by 42
2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
2021WaveGuard: Understanding and Mitigating Audio Adversarial Examplescited by 39
2021Biometrics: Trust, but Verifycited by 39
2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
2021Adversarial Robustness with Semi-Infinite Constrained Learningcited by 39
2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
2021Imperceptible Transfer Attack and Defense on 3D Point Cloud Classificationcited by 36
2021Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safetycited by 35
2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34

50 most cited of 517 All 517 (JSON)