mlsanityData to 14 Oct 2026

Mitigating Adversarial Effects Through Randomization

arXiv 1711.01991 ↗First posted 6 Nov 2017cs.CVcited by 383

Not on the map. Why?

Abstract (arXiv)

Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.

Key facts. Cited by 383 papers in the map (data through 14 Oct 2026). First posted on arXiv 6 Nov 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 110; 2022: 66; 2023: 84; 2024: 49; 2025: 55; 2026: 19.

383 papers.

Sort:

By area:

  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  2. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 168
  3. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  4. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 153
  5. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  6. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
  7. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  8. 2023How Does Information Bottleneck Help Deep Learning?cited by 93
  9. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 92
  10. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  11. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  12. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
38 more
  1. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 79
  2. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 74
  3. 2023Content-based Unrestricted Adversarial Attackcited by 73
  4. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
  5. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
  6. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  7. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
  8. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  9. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  10. 2021Person Re-identification Method Based on Color Attack and Joint Defencecited by 56
  11. 2021Meta Gradient Adversarial Attackcited by 55
  12. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
  13. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  14. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 49
  15. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  16. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  17. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  18. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  19. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  20. 2023Adversarial Prompt Tuning for Vision-Language Modelscited by 44
  21. 2021A Comprehensive Evaluation Framework for Deep Model Robustnesscited by 42
  22. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
  23. 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
  24. 2021WaveGuard: Understanding and Mitigating Audio Adversarial Examplescited by 40
  25. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 40
  26. 2021Biometrics: Trust, but Verifycited by 39
  27. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  28. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  29. 2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
  30. 2021Imperceptible Transfer Attack and Defense on 3D Point Cloud Classificationcited by 36
  31. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  32. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  33. 2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
  34. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  35. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  36. 2021Attacking Adversarial Attacks as A Defensecited by 32
  37. 2021Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrificecited by 30
  38. 2022Towards Efficient Adversarial Training on Vision Transformerscited by 30

50 most cited of 383 All 383 (JSON)