# Adversarial Noise Layer: Regularize Neural Network By Adding Noise

arXiv: https://arxiv.org/abs/1805.08000 · HTML: https://mlsanity.com/paper/1805.08000/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 May 2018.

## Built on by (most cited first, 25 of 25)

- [SecureBERT: A Domain-Specific Language Model for Cybersecurity](https://mlsanity.com/paper/2204.02685/) (2022)
- [A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologies](https://mlsanity.com/paper/2203.14046/) (2022)
- [Nonlinear Sufficient Dimension Reduction with a Stochastic Neural Network](https://mlsanity.com/paper/2210.04349/) (2022)
- [Improving Model Robustness with Latent Distribution Locally and Globally](https://mlsanity.com/paper/2107.04401/) (2021)
- [A Kernel-Expanded Stochastic Neural Network](https://mlsanity.com/paper/2201.05319/) (2022)
- [Noise Optimization for Artificial Neural Networks](https://mlsanity.com/paper/2102.04450/) (2021)
- [Robust Backdoor Attacks on Object Detection in Real World](https://mlsanity.com/paper/2309.08953/) (2023)
- [A Novel Noise Injection-based Training Scheme for Better Model Robustness](https://mlsanity.com/paper/2302.10802/) (2023)
- [Time and State Dependent Neural Delay Differential Equations](https://mlsanity.com/paper/2306.14545/) (2023)
- [Saliency Diversified Deep Ensemble for Robustness to Adversaries](https://mlsanity.com/paper/2112.03615/) (2021)
- [AnalogVNN: A fully modular framework for modeling and optimizing photonic neural networks](https://mlsanity.com/paper/2210.10048/) (2022)
- [Arabic Sentiment Analysis with Noisy Deep Explainable Model](https://mlsanity.com/paper/2309.13731/) (2023)
- [SQUAT: Stateful Quantization-Aware Training in Recurrent Spiking Neural Networks](https://mlsanity.com/paper/2404.19668/) (2024)
- [Density Regression and Uncertainty Quantification with Bayesian Deep Noise Neural Networks](https://mlsanity.com/paper/2206.05643/) (2022)
- [Noise Injection Node Regularization for Robust Learning](https://mlsanity.com/paper/2210.15764/) (2022)
- [CNN-based real-time 2D-3D deformable registration from a single X-ray projection](https://mlsanity.com/paper/2212.07692/) (2022)
- [The Paradox of Noise: An Empirical Study of Noise-Infusion Mechanisms to Improve Generalization, Stability, and Privacy in Federated Learning](https://mlsanity.com/paper/2311.05790/) (2023)
- [Advances in Electron Microscopy with Deep Learning](https://mlsanity.com/paper/2101.01178/) (2021)
- [Unsupervised Sentiment Analysis by Transferring Multi-source Knowledge](https://mlsanity.com/paper/2105.11902/) (2021)
- [NeuralDP Differentially private neural networks by design](https://mlsanity.com/paper/2107.14582/) (2021)
- [FACM: Intermediate Layer Still Retain Effective Features against Adversarial Examples](https://mlsanity.com/paper/2206.00924/) (2022)
- [Adversarial Attacks Neutralization via Data Set Randomization](https://mlsanity.com/paper/2306.12161/) (2023)
- [Semiotics Networks Representing Perceptual Inference](https://mlsanity.com/paper/2310.05212/) (2023)
- [VISP: Volatility Informed Stochastic Projection for Adaptive Regularization](https://mlsanity.com/paper/2509.01903/) (2025)
- [Paradoxical noise preference in RNNs](https://mlsanity.com/paper/2601.04539/) (2026)

## Abstract (arXiv)

In this paper, we introduce a novel regularization method called Adversarial Noise Layer (ANL) and its efficient version called Class Adversarial Noise Layer (CANL), which are able to significantly improve CNN's generalization ability by adding carefully crafted noise into the intermediate layer activations. ANL and CANL can be easily implemented and integrated with most of the mainstream CNN-based models. We compared the effects of the different types of noise and visually demonstrate that our proposed adversarial noise instruct CNN models to learn to extract cleaner feature maps, which further reduce the risk of over-fitting. We also conclude that models trained with ANL or CANL are more robust to the adversarial examples generated by FGSM than the traditional adversarial training approaches.