# Moving Target Defense for Deep Visual Sensing against Adversarial Examples

arXiv: https://arxiv.org/abs/1905.13148 · HTML: https://mlsanity.com/paper/1905.13148/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 May 2019.

## Built on by (most cited first, 7 of 7)

- [Morphence: Moving Target Defense Against Adversarial Examples](https://mlsanity.com/paper/2108.13952/) (2021)
- [Rethinking Machine Learning Robustness via its Link with the Out-of-Distribution Problem](https://mlsanity.com/paper/2202.08944/) (2022)
- [Sardino: Ultra-Fast Dynamic Ensemble for Secure Visual Sensing at Mobile Edge](https://mlsanity.com/paper/2204.08189/) (2022)
- [Morphence-2.0: Evasion-Resilient Moving Target Defense Powered by Out-of-Distribution Detection](https://mlsanity.com/paper/2206.07321/) (2022)
- [DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization](https://mlsanity.com/paper/2412.07672/) (2024)
- [LightPure: Realtime Adversarial Image Purification for Mobile Devices Using Diffusion Models](https://mlsanity.com/paper/2409.00340/) (2024)
- [AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving](https://mlsanity.com/paper/2608.16031/) (2026)

## Abstract (arXiv)

Deep learning based visual sensing has achieved attractive accuracy but is shown vulnerable to adversarial example attacks. Specifically, once the attackers obtain the deep model, they can construct adversarial examples to mislead the model to yield wrong classification results. Deployable adversarial examples such as small stickers pasted on the road signs and lanes have been shown effective in misleading advanced driver-assistance systems. Many existing countermeasures against adversarial examples build their security on the attackers' ignorance of the defense mechanisms. Thus, they fall short of following Kerckhoffs's principle and can be subverted once the attackers know the details of the defense. This paper applies the strategy of moving target defense (MTD) to generate multiple new deep models after system deployment, that will collaboratively detect and thwart adversarial examples. Our MTD design is based on the adversarial examples' minor transferability to models differing from the one (e.g., the factory-designed model) used for attack construction. The post-deployment quasi-secret deep models significantly increase the bar for the attackers to construct effective adversarial examples. We also apply the technique of serial data fusion with early stopping to reduce the inference time by a factor of up to 5 while maintaining the sensing and defense performance. Extensive evaluation based on three datasets including a road sign image database and a GPU-equipped Jetson embedded computing board shows the effectiveness of our approach.