Data to 14 Oct 2026

Improving Adversarial Robustness of Ensembles with Diversity Training

arXiv 1901.09981 ↗First posted 28 Jan 2019stat.ML cs.LGcited by 69

Not on the map. Why?

Abstract (arXiv)

Deep Neural Networks are vulnerable to adversarial attacks even in settings where the attacker has no direct access to the model being attacked. Such attacks usually rely on the principle of transferability, whereby an attack crafted on a surrogate model tends to transfer to the target model. We show that an ensemble of models with misaligned loss gradients can provide an effective defense against transfer-based attacks. Our key insight is that an adversarial example is less likely to fool multiple models in the ensemble if their loss functions do not increase in a correlated fashion. To this end, we propose Diversity Training, a novel method to train an ensemble of models with uncorrelated loss functions. We show that our method significantly improves the adversarial robustness of ensembles and can also be combined with existing methods to create a stronger defense.

Key facts. Cited by 69 papers in the map (data through 14 Oct 2026). First posted on arXiv 28 Jan 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 21; 2022: 12; 2023: 14; 2024: 12; 2025: 9; 2026: 1.

69 papers.

Sort:

By area:

2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
20223D Common Corruptions and Data Augmentationcited by 119
2021Evading the Simplicity Bias: Training a Diverse Set of Models Discovers Solutions with Superior OOD Generalizationcited by 83
2022Agree to Disagree: Diversity through Disagreement for Better Transferabilitycited by 70
2021DICE: Diversity in Deep Ensembles via Conditional Redundancy Adversarial Estimationcited by 48
2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 38
2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
2021Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attackscited by 24
2021Robustness via Cross-Domain Ensemblescited by 23
2022A Survey of Adversarial Defences and Robustness in NLPcited by 23

38 more

2023Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixupcited by 17
2023Pathologies of Predictive Diversity in Deep Ensemblescited by 16
2023Understanding and Improving Ensemble Adversarial Defensecited by 14
2021Learning Diverse-Structured Networks for Adversarial Robustnesscited by 12
2024Collaboration! Towards Robust Neural Methods for Routing Problemscited by 9
2021Adversarial Transfer Attacks With Unknown Data and Class Overlapcited by 8
2022Improving robustness and calibration in ensembles with diversity regularizationcited by 8
2022Building Robust Ensembles via Margin Boostingcited by 8
2023MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detectioncited by 8
2023Semantic and Expressive Variation in Image Captions Across Languagescited by 8
2022MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attackcited by 7
2024DIVE: Subgraph Disagreement for Graph Out-of-Distribution Generalizationcited by 7
2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
2021Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbationscited by 6
2021Approximate Neural Architecture Search via Operation Distribution Learningcited by 6
2021Push Stricter to Decide Better: A Class-Conditional Feature Adaptive Framework for Improving Adversarial Robustnesscited by 6
2024Survey of Computerized Adaptive Testing: A Machine Learning Perspectivecited by 6
2022Adversarial Vulnerability of Randomized Ensemblescited by 5
2024Towards Adversarial Robustness of Model-Level Mixture-of-Experts Architectures for Semantic Segmentationcited by 5
2022Resisting Adversarial Attacks in Deep Neural Networks using Diverse Decision Boundariescited by 4
2023On the Role of Randomization in Adversarially Robust Classificationcited by 4
2021Greedy Bayesian Posterior Approximation with Deep Ensemblescited by 3
2023On the Robustness of Randomized Ensembles to Adversarial Perturbationscited by 3
2023Multi-attacks: Many images + the same adversarial attack → many target labelscited by 3
2024Improving Transferable Targeted Adversarial Attack via Normalized Logit Calibration and Truncated Feature Mixingcited by 3
2021"What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Modelscited by 2
2021Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustnesscited by 2
2021Saliency Diversified Deep Ensemble for Robustness to Adversariescited by 2
2022Adversarial Ensemble Training by Jointly Learning Label Dependencies and Member Modelscited by 2
2023Certifying Ensembles: A General Certification Theory with S-Lipschitznesscited by 2
2023Dynamic ensemble selection based on Deep Neural Network Uncertainty Estimation for Adversarial Robustnesscited by 2
2024Adversarial Training via Adaptive Knowledge Amalgamation of an Ensemble of Teacherscited by 2
2025Robust Confinement State Classification with Uncertainty Quantification through Ensembled Data-Driven Methodscited by 2
2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 2
2025Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferabilitycited by 2
2021CoG: a Two-View Co-training Framework for Defending Adversarial Attacks on Graphcited by 1
2021Evolving Architectures with Gradient Misalignment toward Low Adversarial Transferabilitycited by 1
2021Mitigating Adversarial Attacks by Distributing Different Copies to Different Userscited by 1

50 most cited of 69 All 69 (JSON)