# One Man's Trash is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples

arXiv: https://arxiv.org/abs/1911.11219 · HTML: https://mlsanity.com/paper/1911.11219/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Nov 2019.

## Built on by (most cited first, 8 of 8)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Stereoscopic Universal Perturbations across Different Architectures and Datasets](https://mlsanity.com/paper/2112.06116/) (2021)
- [Game Theoretic Mixed Experts for Combinational Adversarial Machine Learning](https://mlsanity.com/paper/2211.14669/) (2022)
- [ETA: Energy-based Test-time Adaptation for Depth Completion](https://mlsanity.com/paper/2508.05989/) (2025)
- [Delving into Deep Image Prior for Adversarial Defense: A Novel Reconstruction-based Defense Framework](https://mlsanity.com/paper/2108.00180/) (2021)
- ["What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models](https://mlsanity.com/paper/2102.05104/) (2021)
- [Certifying Adapters: Enabling and Enhancing the Certification of Classifier Adversarial Robustness](https://mlsanity.com/paper/2405.16036/) (2024)
- [CAP-GAN: Towards Adversarial Robustness with Cycle-consistent Attentional Purification](https://mlsanity.com/paper/2102.07304/) (2021)

## Abstract (arXiv)

Modern image classification systems are often built on deep neural networks, which suffer from adversarial examples--images with deliberately crafted, imperceptible noise to mislead the network's classification. To defend against adversarial examples, a plausible idea is to obfuscate the network's gradient with respect to the input image. This general idea has inspired a long line of defense methods. Yet, almost all of them have proven vulnerable. We revisit this seemingly flawed idea from a radically different perspective. We embrace the omnipresence of adversarial examples and the numerical procedure of crafting them, and turn this harmful attacking process into a useful defense mechanism. Our defense method is conceptually simple: before feeding an input image for classification, transform it by finding an adversarial example on a pre-trained external model. We evaluate our method against a wide range of possible attacks. On both CIFAR-10 and Tiny ImageNet datasets, our method is significantly more robust than state-of-the-art methods. Particularly, in comparison to adversarial training, our method offers lower training cost as well as stronger robustness.