# Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network"

arXiv: https://arxiv.org/abs/1907.00895 · HTML: https://mlsanity.com/paper/1907.00895/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Jul 2019.

## Built on by (most cited first, 12 of 12)

- [GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularization](https://mlsanity.com/paper/2107.02425/) (2021)
- [Benchmarking the Accuracy and Robustness of Feedback Alignment Algorithms](https://mlsanity.com/paper/2108.13446/) (2021)
- [LoRID: Low-Rank Iterative Diffusion for Adversarial Purification](https://mlsanity.com/paper/2409.08255/) (2024)
- [Bayesian Learning with Information Gain Provably Bounds Risk for a Robust Adversarial Defense](https://mlsanity.com/paper/2212.02003/) (2022)
- [The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks](https://mlsanity.com/paper/2101.02689/) (2021)
- [Mitigating Closed-model Adversarial Examples with Bayesian Neural Modeling for Enhanced End-to-End Speech Recognition](https://mlsanity.com/paper/2202.08532/) (2022)
- [Attacking Bayes: On the Adversarial Robustness of Bayesian Neural Networks](https://mlsanity.com/paper/2404.19640/) (2024)
- [Improving Adversarial Robustness via Decoupled Visual Representation Masking](https://mlsanity.com/paper/2406.10933/) (2024)
- [Spatial-Frequency Discriminability for Revealing Adversarial Perturbations](https://mlsanity.com/paper/2305.10856/) (2023)
- [Transgressing the boundaries: towards a rigorous understanding of deep learning and its (non-)robustness](https://mlsanity.com/paper/2307.02454/) (2023)
- [How to Backdoor Image Knowledge Distillation](https://mlsanity.com/paper/2504.21323/) (2025)
- [A combination of noise and bilateral filters achieve supralinear and scalable adversarial robustness in CNNs](https://mlsanity.com/paper/2606.02267/) (2026)

## Abstract (arXiv)

A recent paper by Liu et al. combines the topics of adversarial training and Bayesian Neural Networks (BNN) and suggests that adversarially trained BNNs are more robust against adversarial attacks than their non-Bayesian counterparts. Here, I analyze the proposed defense and suggest that one needs to adjust the adversarial attack to incorporate the stochastic nature of a Bayesian network to perform an accurate evaluation of its robustness. Using this new type of attack I show that there appears to be no strong evidence for higher robustness of the adversarially trained BNNs.