mlsanityData to 7 Oct 2026

Enhancing Adversarial Robustness via Test-time Transformation Ensembling

arXiv 2107.14110 ↗First posted 29 Jul 2021cs.LG cs.CR cs.CVcited by 27

Not on the map. Why?

Abstract (arXiv)

Deep learning models are prone to being fooled by imperceptible perturbations known as adversarial attacks. In this work, we study how equipping models with Test-time Transformation Ensembling (TTE) can work as a reliable defense against such attacks. While transforming the input data, both at train and test times, is known to enhance model performance, its effects on adversarial robustness have not been studied. Here, we present a comprehensive empirical study of the impact of TTE, in the form of widely-used image transforms, on adversarial robustness. We show that TTE consistently improves model robustness against a variety of powerful attacks without any need for re-training, and that this improvement comes at virtually no trade-off with accuracy on clean samples. Finally, we show that the benefits of TTE transfer even to the certified robustness domain, in which TTE provides sizable and consistent improvements.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Builds on 42 of its 61 references that are in the map. First posted on arXiv 29 Jul 2021.

Builds on

42 of 61 references.

References · 42

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,346
  8. 2014Going Deeper with Convolutionscited by 4,231
  9. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  10. 2013Playing Atari with Deep Reinforcement Learningcited by 3,211
  11. 2016Wide Residual Networkscited by 3,057
  12. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
30 more
  1. 2016Adversarial examples in the physical worldcited by 1,762
  2. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  8. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  9. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  10. 2019On Evaluating Adversarial Robustnesscited by 442
  11. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  12. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  13. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  14. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  15. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  16. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  17. 2018Certified Defenses against Adversarial Examplescited by 305
  18. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  19. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  20. 2013OverFeat: Integrated Recognition, Localization and Detection using Convolutional Networkscited by 224
  21. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  22. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
  23. 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 152
  24. 2020Adversarial Self-Supervised Contrastive Learningcited by 138
  25. 2016Fully Convolutional Instance-aware Semantic Segmentationcited by 122
  26. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  27. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  28. 2020Learning Loss for Test-Time Augmentationcited by 56
  29. 2020Efficient Robust Training via Backward Smoothingcited by 29
  30. 2016A MultiPath Network for Object Detectioncited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 2; 2023: 10; 2024: 2; 2025: 6; 2026: 6.

27 papers.

Sort:

By area:

  1. 2023A Comprehensive Survey on Test-Time Adaptation under Distribution Shiftscited by 353
  2. 2023Robust Classification via a Single Diffusion Modelcited by 79
  3. 2023Adversarial Counterfactual Visual Explanationscited by 47
  4. 2025CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIPcited by 23
  5. 2023Convolutional Visual Prompt for Robust Visual Perceptioncited by 17
  6. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  7. 2024GDA: Generalized Diffusion for Robust Test-time Adaptationcited by 14
  8. 2025Enhancing CLIP Robustness via Cross-Modality Alignmentcited by 14
  9. 2023Evaluation of Test-Time Adaptation Under Computational Time Constraintscited by 13
  10. 2023From Channel Bias to Feature Redundancy: Uncovering the "Less is More" Principle in Few-Shot Learningcited by 9
  11. 2022Addressing Heterogeneity in Federated Learning via Distributional Transformationcited by 6
  12. 2023Class-Conditioned Transformation for Enhanced Robust Image Classificationcited by 5
15 more
  1. 2021Simple Post-Training Robustness Using Test Time Augmentations and Random Forestcited by 4
  2. 2022Dynamic Test-Time Augmentation via Differentiable Functionscited by 4
  3. 2023Test-time Detection and Repair of Adversarial Samples via Masked Autoencodercited by 4
  4. 2025Test-time augmentation improves efficiency in conformal predictioncited by 3
  5. 2025Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensemblescited by 2
  6. 2026Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIPcited by 2
  7. 2025ADVMEM: Adversarial Memory Initialization for Realistic Test-Time Adaptation via Tracklet-Based Benchmarkingcited by 1
  8. 2025ATAC: Augmentation-Based Test-Time Adversarial Correction for CLIPcited by 1
  9. 2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1
  10. 2026When CLIP Sees More, It Fights Back Harder: Multi-View Guided Adaptive Counterattacks for Test-Time Adversarial Robustnesscited by 1
  11. 2023Enhancing Neural Rendering Methods with Image Augmentationscited by 0
  12. 2024DataFreeShield: Defending Adversarial Attacks without Training Datacited by 0
  13. 2026What Makes VLMs Robust? Towards Reconciling Robustness and Accuracy in Vision-Language Modelscited by 0
  14. 2026Reliability-Guided Adaptive Ensembling for Robust Test-Time Adaptationcited by 0
  15. 2026ReACT-CLIP: Response-Aware Test-Time Defense for Vision--Language Modelscited by 0