# Toward Adversarial Robustness by Diversity in an Ensemble of Specialized Deep Neural Networks

arXiv: https://arxiv.org/abs/2005.08321 · HTML: https://mlsanity.com/paper/2005.08321/

## Key facts

- Cited by 7 papers in the map (data through 7 Oct 2026).
- First posted on arXiv 17 May 2020.

## Built on by (most cited first, 7 of 7)

- [Temperature as Uncertainty in Contrastive Learning](https://mlsanity.com/paper/2110.04403/) (2021)
- [Learning Diverse-Structured Networks for Adversarial Robustness](https://mlsanity.com/paper/2102.01886/) (2021)
- [Towards Inference Efficient Deep Ensemble Learning](https://mlsanity.com/paper/2301.12378/) (2023)
- [The robust way to stack and bag: the local Lipschitz way](https://mlsanity.com/paper/2206.00513/) (2022)
- [Learning Robust Kernel Ensembles with Kernel Average Pooling](https://mlsanity.com/paper/2210.00062/) (2022)
- [QuantifyML: How Good is my Machine Learning Model?](https://mlsanity.com/paper/2110.12588/) (2021)
- [Measuring the Contribution of Multiple Model Representations in Detecting Adversarial Instances](https://mlsanity.com/paper/2111.07035/) (2021)

## Abstract (arXiv)

We aim at demonstrating the influence of diversity in the ensemble of CNNs on the detection of black-box adversarial instances and hardening the generation of white-box adversarial attacks. To this end, we propose an ensemble of diverse specialized CNNs along with a simple voting mechanism. The diversity in this ensemble creates a gap between the predictive confidences of adversaries and those of clean samples, making adversaries detectable. We then analyze how diversity in such an ensemble of specialists may mitigate the risk of the black-box and white-box adversarial examples. Using MNIST and CIFAR-10, we empirically verify the ability of our ensemble to detect a large portion of well-known black-box adversarial examples, which leads to a significant reduction in the risk rate of adversaries, at the expense of a small increase in the risk rate of clean samples. Moreover, we show that the success rate of generating white-box attacks by our ensemble is remarkably decreased compared to a vanilla CNN and an ensemble of vanilla CNNs, highlighting the beneficial role of diversity in the ensemble for developing more robust models.