# Robust Neural Networks using Randomized Adversarial Training

arXiv: https://arxiv.org/abs/1903.10219 · HTML: https://mlsanity.com/paper/1903.10219/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Mar 2019.

## Built on by (most cited first, 4 of 4)

- [Random Boxes Are Open-world Object Detectors](https://mlsanity.com/paper/2307.08249/) (2023)
- [Explainable Adversarial Attacks in Deep Neural Networks Using Activation Profiles](https://mlsanity.com/paper/2103.10229/) (2021)
- [Adversarial Training: A Survey](https://mlsanity.com/paper/2410.15042/) (2024)
- [Random Projections for Improved Adversarial Robustness](https://mlsanity.com/paper/2102.09230/) (2021)

## Abstract (arXiv)

This paper tackles the problem of defending a neural network against adversarial attacks crafted with different norms (in particular ℓ_∞ and ℓ2 bounded adversarial examples). It has been observed that defense mechanisms designed to protect against one type of attacks often offer poor performance against the other. We show that ℓ_∞ defense mechanisms cannot offer good protection against ℓ2 attacks and vice-versa, and we provide both theoretical and empirical insights on this phenomenon. Then, we discuss various ways of combining existing defense mechanisms in order to train neural networks robust against both types of attacks. Our experiments show that these new defense mechanisms offer better protection when attacked with both norms.