# Defending against adversarial attacks by randomized diversification

arXiv: https://arxiv.org/abs/1904.00689 · HTML: https://mlsanity.com/paper/1904.00689/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Apr 2019.

## Built on by (most cited first, 14 of 14)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [An Introduction to Johnson-Lindenstrauss Transforms](https://mlsanity.com/paper/2103.00564/) (2021)
- [The art of defense: letting networks fool the attacker](https://mlsanity.com/paper/2104.02963/) (2021)
- [Rethinking Textual Adversarial Defense for Pre-trained Language Models](https://mlsanity.com/paper/2208.10251/) (2022)
- [Resisting Deep Learning Models Against Adversarial Attack Transferability via Feature Randomization](https://mlsanity.com/paper/2209.04930/) (2022)
- [Continual Adversarial Defense](https://mlsanity.com/paper/2312.09481/) (2023)
- [Saliency Diversified Deep Ensemble for Robustness to Adversaries](https://mlsanity.com/paper/2112.03615/) (2021)
- [Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removal](https://mlsanity.com/paper/2507.21750/) (2025)
- [Structure-Preserving Progressive Low-rank Image Completion for Defending Adversarial Attacks](https://mlsanity.com/paper/2103.02781/) (2021)
- [Adversarial Defense via Image Denoising with Chaotic Encryption](https://mlsanity.com/paper/2203.10290/) (2022)
- [FACM: Intermediate Layer Still Retain Effective Features against Adversarial Examples](https://mlsanity.com/paper/2206.00924/) (2022)
- [Adversarial Attacks Neutralization via Data Set Randomization](https://mlsanity.com/paper/2306.12161/) (2023)
- [A Curious Case of Remarkable Resilience to Gradient Attacks via Fully Convolutional and Differentiable Front End with a Skip Connection](https://mlsanity.com/paper/2402.17018/) (2024)
- [SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models](https://mlsanity.com/paper/2505.16318/) (2025)

## Abstract (arXiv)

The vulnerability of machine learning systems to adversarial attacks questions their usage in many applications. In this paper, we propose a randomized diversification as a defense strategy. We introduce a multi-channel architecture in a gray-box scenario, which assumes that the architecture of the classifier and the training data set are known to the attacker. The attacker does not only have access to a secret key and to the internal states of the system at the test time. The defender processes an input in multiple channels. Each channel introduces its own randomization in a special transform domain based on a secret key shared between the training and testing stages. Such a transform based randomization with a shared key preserves the gradients in key-defined sub-spaces for the defender but it prevents gradient back propagation and the creation of various bypass systems for the attacker. An additional benefit of multi-channel randomization is the aggregation that fuses soft-outputs from all channels, thus increasing the reliability of the final score. The sharing of a secret key creates an information advantage to the defender. Experimental evaluation demonstrates an increased robustness of the proposed method to a number of known state-of-the-art attacks.