# Defending against Whitebox Adversarial Attacks via Randomized Discretization

arXiv: https://arxiv.org/abs/1903.10586 · HTML: https://mlsanity.com/paper/1903.10586/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Mar 2019.

## Built on by (most cited first, 29 of 29)

- [Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics](https://mlsanity.com/paper/2411.13587/) (2024)
- [Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches](https://mlsanity.com/paper/2207.04718/) (2022)
- [TPatch: A Triggered Physical Adversarial Patch](https://mlsanity.com/paper/2401.00148/) (2023)
- [Universal Spectral Adversarial Attacks for Deformable Shapes](https://mlsanity.com/paper/2104.03356/) (2021)
- [Demystifying the Adversarial Robustness of Random Transformation Defenses](https://mlsanity.com/paper/2207.03574/) (2022)
- [Learning Diverse-Structured Networks for Adversarial Robustness](https://mlsanity.com/paper/2102.01886/) (2021)
- [AdvART: Adversarial Art for Camouflaged Object Detection Attacks](https://mlsanity.com/paper/2303.01734/) (2023)
- [SAAM: Stealthy Adversarial Attack on Monocular Depth Estimation](https://mlsanity.com/paper/2308.03108/) (2023)
- [APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigation](https://mlsanity.com/paper/2303.01351/) (2023)
- [Reliable learning in challenging environments](https://mlsanity.com/paper/2304.03370/) (2023)
- [Outlier Robust Adversarial Training](https://mlsanity.com/paper/2309.05145/) (2023)
- [The art of defense: letting networks fool the attacker](https://mlsanity.com/paper/2104.02963/) (2021)
- [Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks](https://mlsanity.com/paper/2106.07141/) (2021)
- [Improving the Robustness of Adversarial Attacks Using an Affine-Invariant Gradient Estimator](https://mlsanity.com/paper/2109.05820/) (2021)
- [ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Driving](https://mlsanity.com/paper/2406.05810/) (2024)
- [Rethinking Textual Adversarial Defense for Pre-trained Language Models](https://mlsanity.com/paper/2208.10251/) (2022)
- [Improving Adversarial Transferability with Scheduled Step Size and Dual Example](https://mlsanity.com/paper/2301.12968/) (2023)
- [SlowPerception: Physical-World Latency Attack against Visual Perception in Autonomous Driving](https://mlsanity.com/paper/2406.05800/) (2024)
- [Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systems](https://mlsanity.com/paper/2307.08939/) (2023)
- [A Novel Perturb-ability Score to Mitigate Evasion Adversarial Attacks on Flow-Based ML-NIDS](https://mlsanity.com/paper/2409.07448/) (2024)
- [Constant Random Perturbations Provide Adversarial Robustness with Minimal Effect on Accuracy](https://mlsanity.com/paper/2103.08265/) (2021)
- [MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis](https://mlsanity.com/paper/2104.10076/) (2021)
- [On Procedural Adversarial Noise Attack And Defense](https://mlsanity.com/paper/2108.04409/) (2021)
- [Pixel to Binary Embedding Towards Robustness for CNNs](https://mlsanity.com/paper/2206.05898/) (2022)
- [Scoring Black-Box Models for Adversarial Robustness](https://mlsanity.com/paper/2210.17140/) (2022)
- [Adversarial Defenses via Vector Quantization](https://mlsanity.com/paper/2305.13651/) (2023)
- [Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patches](https://mlsanity.com/paper/2407.17312/) (2024)
- [T2I-Based Physical-World Appearance Attack against Traffic Sign Recognition Systems in Autonomous Driving](https://mlsanity.com/paper/2511.12956/) (2025)
- [A Classifier-Agnostic Zero-Shot Adversarial Attack Detection via CLIP](https://mlsanity.com/paper/2606.30342/) (2026)

## Abstract (arXiv)

Adversarial perturbations dramatically decrease the accuracy of state-of-the-art image classifiers. In this paper, we propose and analyze a simple and computationally efficient defense strategy: inject random Gaussian noise, discretize each pixel, and then feed the result into any pre-trained classifier. Theoretically, we show that our randomized discretization strategy reduces the KL divergence between original and adversarial inputs, leading to a lower bound on the classification accuracy of any classifier against any (potentially whitebox) ℓ_∞-bounded adversarial attack. Empirically, we evaluate our defense on adversarial examples generated by a strong iterative PGD attack. On ImageNet, our defense is more robust than adversarially-trained networks and the winning defenses of the NIPS 2017 Adversarial Attacks & Defenses competition.