# Training Ensembles to Detect Adversarial Examples

arXiv: https://arxiv.org/abs/1712.04006 · HTML: https://mlsanity.com/paper/1712.04006/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Dec 2017.

## Built on by (most cited first, 10 of 10)

- [Evading the Simplicity Bias: Training a Diverse Set of Models Discovers Solutions with Superior OOD Generalization](https://mlsanity.com/paper/2105.05612/) (2021)
- [Robustness-enhanced Uplift Modeling with Adversarial Feature Desensitization](https://mlsanity.com/paper/2310.04693/) (2023)
- [Meta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attacks](https://mlsanity.com/paper/2404.03340/) (2024)
- [Defense without Forgetting: Continual Adversarial Defense with Anisotropic & Isotropic Pseudo Replay](https://mlsanity.com/paper/2404.01828/) (2024)
- [Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness](https://mlsanity.com/paper/2103.14795/) (2021)
- [Measuring the Contribution of Multiple Model Representations in Detecting Adversarial Instances](https://mlsanity.com/paper/2111.07035/) (2021)
- [Defending Adversarial Examples by Negative Correlation Ensemble](https://mlsanity.com/paper/2206.10334/) (2022)
- [Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training](https://mlsanity.com/paper/2312.00105/) (2023)
- [Invariance-powered Trustworthy Defense via Remove Then Restore](https://mlsanity.com/paper/2402.00304/) (2024)
- [SHIELD: Secure Hypernetworks for Incremental Expansion Learning Defense](https://mlsanity.com/paper/2506.08255/) (2025)

## Abstract (arXiv)

We propose a new ensemble method for detecting and classifying adversarial examples generated by state-of-the-art attacks, including DeepFool and C&W. Our method works by training the members of an ensemble to have low classification error on random benign examples while simultaneously minimizing agreement on examples outside the training distribution. We evaluate on both MNIST and CIFAR-10, against oblivious and both white- and black-box adversaries.