# Learn2Perturb: an End-to-end Feature Perturbation Learning to Improve Adversarial Robustness

arXiv: https://arxiv.org/abs/2003.01090 · HTML: https://mlsanity.com/paper/2003.01090/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Mar 2020.

## Built on by (most cited first, 27 of 27)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [MT3: Meta Test-Time Training for Self-Supervised Test-Time Adaption](https://mlsanity.com/paper/2103.16201/) (2021)
- [How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Review](https://mlsanity.com/paper/2107.12045/) (2021)
- [The Many Faces of Adversarial Risk](https://mlsanity.com/paper/2201.08956/) (2022)
- [TTAPS: Test-Time Adaption by Aligning Prototypes using Self-Supervision](https://mlsanity.com/paper/2205.08731/) (2022)
- [Tackling covariate shift with node-based Bayesian neural networks](https://mlsanity.com/paper/2206.02435/) (2022)
- [Data Optimization in Deep Learning: A Survey](https://mlsanity.com/paper/2310.16499/) (2023)
- [A Cognitive Framework for Delegation Between Error-Prone AI and Human Agents](https://mlsanity.com/paper/2204.02889/) (2022)
- [Domain Adaptation with Adversarial Training on Penultimate Activations](https://mlsanity.com/paper/2208.12853/) (2022)
- [Simple Post-Training Robustness Using Test Time Augmentations and Random Forest](https://mlsanity.com/paper/2109.08191/) (2021)
- [LeNo: Adversarial Robust Salient Object Detection Networks with Learnable Noise](https://mlsanity.com/paper/2210.15392/) (2022)
- [Adversarial Attacks and Defenses in Multivariate Time-Series Forecasting for Smart and Connected Infrastructures](https://mlsanity.com/paper/2408.14875/) (2024)
- [Rethinking Feature Uncertainty in Stochastic Neural Networks for Adversarial Robustness](https://mlsanity.com/paper/2201.00148/) (2022)
- [Attacking Adversarial Defences by Smoothing the Loss Landscape](https://mlsanity.com/paper/2208.00862/) (2022)
- [Effective and Robust Multimodal Medical Image Analysis](https://mlsanity.com/paper/2602.15346/) (2026)
- [Robustness-via-Synthesis: Robust Training with Generative Adversarial Perturbations](https://mlsanity.com/paper/2108.09713/) (2021)
- [How Sampling Impacts the Robustness of Stochastic Neural Networks](https://mlsanity.com/paper/2204.10839/) (2022)
- [Gradient Obfuscation Checklist Test Gives a False Sense of Security](https://mlsanity.com/paper/2206.01705/) (2022)
- [Two Heads are Better than One: Robust Learning Meets Multi-branch Models](https://mlsanity.com/paper/2208.08083/) (2022)
- [Counterfactual Image Generation for adversarially robust and interpretable Classifiers](https://mlsanity.com/paper/2310.00761/) (2023)
- [Adversarial Augmentation Training Makes Action Recognition Models More Robust to Realistic Video Distribution Shifts](https://mlsanity.com/paper/2401.11406/) (2024)
- [Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticity](https://mlsanity.com/paper/2605.01519/) (2026)
- [HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks](https://mlsanity.com/paper/2106.05825/) (2021)
- [Towards A Conceptually Simple Defensive Approach for Few-shot classifiers Against Adversarial Support Samples](https://mlsanity.com/paper/2110.12357/) (2021)
- [DNNShield: Dynamic Randomized Model Sparsification, A Defense Against Adversarial Machine Learning](https://mlsanity.com/paper/2208.00498/) (2022)
- [Enhance DNN Adversarial Robustness and Efficiency via Injecting Noise to Non-Essential Neurons](https://mlsanity.com/paper/2402.04325/) (2024)
- [Feature Statistics with Uncertainty Help Adversarial Robustness](https://mlsanity.com/paper/2503.20583/) (2025)

## Abstract (arXiv)

While deep neural networks have been achieving state-of-the-art performance across a wide variety of applications, their vulnerability to adversarial attacks limits their widespread deployment for safety-critical applications. Alongside other adversarial defense approaches being investigated, there has been a very recent interest in improving adversarial robustness in deep neural networks through the introduction of perturbations during the training process. However, such methods leverage fixed, pre-defined perturbations and require significant hyper-parameter tuning that makes them very difficult to leverage in a general fashion. In this study, we introduce Learn2Perturb, an end-to-end feature perturbation learning approach for improving the adversarial robustness of deep neural networks. More specifically, we introduce novel perturbation-injection modules that are incorporated at each layer to perturb the feature space and increase uncertainty in the network. This feature perturbation is performed at both the training and the inference stages. Furthermore, inspired by the Expectation-Maximization, an alternating back-propagation training algorithm is introduced to train the network and noise parameters consecutively. Experimental results on CIFAR-10 and CIFAR-100 datasets show that the proposed Learn2Perturb method can result in deep neural networks which are 4-7% more robust on l∞ FGSM and PDG adversarial attacks and significantly outperforms the state-of-the-art against l2 C&W attack and a wide range of well-known black-box attacks.