# Discretization based Solutions for Secure Machine Learning against Adversarial Attacks

arXiv: https://arxiv.org/abs/1902.03151 · HTML: https://mlsanity.com/paper/1902.03151/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Feb 2019.

## Built on by (most cited first, 10 of 10)

- [Hardware Approximate Techniques for Deep Neural Network Accelerators: A Survey](https://mlsanity.com/paper/2203.08737/) (2022)
- [Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective](https://mlsanity.com/paper/2101.03042/) (2021)
- [Approximate Computing and the Efficient Machine Learning Expedition](https://mlsanity.com/paper/2210.00497/) (2022)
- [2-in-1 Accelerator: Enabling Random Precision Switch for Winning Both Adversarial Robustness and Efficiency](https://mlsanity.com/paper/2109.05223/) (2021)
- [Efficiency-driven Hardware Optimization for Adversarially Robust Neural Networks](https://mlsanity.com/paper/2105.04003/) (2021)
- [Tensor Normalization and Full Distribution Training](https://mlsanity.com/paper/2109.02345/) (2021)
- [Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks](https://mlsanity.com/paper/2101.01543/) (2021)
- [The Impact of Quantization on the Robustness of Transformer-based Text Classifiers](https://mlsanity.com/paper/2403.05365/) (2024)
- [Discretization-based ensemble model for robust learning in IoT](https://mlsanity.com/paper/2307.08955/) (2023)
- [Quantum Computing Supported Adversarial Attack-Resilient Autonomous Vehicle Perception Module for Traffic Sign Classification](https://mlsanity.com/paper/2504.12644/) (2025)

## Abstract (arXiv)

Adversarial examples are perturbed inputs that are designed (from a deep learning network's (DLN) parameter gradients) to mislead the DLN during test time. Intuitively, constraining the dimensionality of inputs or parameters of a network reduces the 'space' in which adversarial examples exist. Guided by this intuition, we demonstrate that discretization greatly improves the robustness of DLNs against adversarial attacks. Specifically, discretizing the input space (or allowed pixel levels from 256 values or 8-bit to 4 values or 2-bit) extensively improves the adversarial robustness of DLNs for a substantial range of perturbations for minimal loss in test accuracy. Furthermore, we find that Binary Neural Networks (BNNs) and related variants are intrinsically more robust than their full precision counterparts in adversarial scenarios. Combining input discretization with BNNs furthers the robustness even waiving the need for adversarial training for certain magnitude of perturbation values. We evaluate the effect of discretization on MNIST, CIFAR10, CIFAR100 and Imagenet datasets. Across all datasets, we observe maximal adversarial resistance with 2-bit input discretization that incurs an adversarial accuracy loss of just ~1-2% as compared to clean test accuracy.