mlsanityData to 7 Oct 2026

Demystifying the Adversarial Robustness of Random Transformation Defenses

arXiv 2207.03574 ↗First posted 18 Jun 2022cs.CR cs.AI cs.CVcited by 14

Not on the map. Why?

Abstract (arXiv)

Neural networks' lack of robustness against attacks raises concerns in security-sensitive settings such as autonomous vehicles. While many countermeasures may look promising, only a few withstand rigorous evaluation. Defenses using random transformations (RT) have shown impressive results, particularly BaRT (Raff et al., 2019) on ImageNet. However, this type of defense has not been rigorously evaluated, leaving its robustness properties poorly understood. Their stochastic properties make evaluation more challenging and render many proposed attacks on deterministic models inapplicable. First, we show that the BPDA attack (Athalye et al., 2018a) used in BaRT's evaluation is ineffective and likely overestimates its robustness. We then attempt to construct the strongest possible RT defense through the informed selection of transformations and Bayesian optimization for tuning their parameters. Furthermore, we create the strongest possible attack to evaluate our RT defense. Our new attack vastly outperforms the baseline, reducing the accuracy by 83% compared to the 19% reduction by the commonly used EoT attack (4.3× improvement). Our result indicates that the RT defense on the Imagenette dataset (a ten-class subset of ImageNet) is not robust against adversarial examples. Extending the study further, we use our new attack to adversarially train RT defense (called AdvRT), resulting in a large robustness gain. Code is available at https://github.com/wagner-group/demystify-random-transform.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 38 of its 50 references that are in the map. First posted on arXiv 18 Jun 2022.

Builds on

38 of 50 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  7. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2018Robustness May Be at Odds with Accuracycited by 873
26 more
  1. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  2. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  3. 2013Stochastic First- and Zeroth-order Methods for Nonconvex Stochastic Programmingcited by 716
  4. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  5. 2018signSGD: Compressed Optimisation for Non-Convex Problemscited by 561
  6. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  7. 2017Countering Adversarial Images using Input Transformationscited by 517
  8. 2018BOHB: Robust and Efficient Hyperparameter Optimization at Scalecited by 466
  9. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  10. 2018Tune: A Research Platform for Distributed Model Selection and Trainingcited by 395
  11. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  12. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  13. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  14. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  15. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
  16. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
  17. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  18. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  19. 2018Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Networkcited by 68
  20. 2019Tuning Hyperparameters without Grad Students: Scalable and Robust Bayesian Optimisation with Dragonflycited by 66
  21. 2017Synthesizing Robust Adversarial Examplescited by 39
  22. 2018Aggregated Momentum: Stability Through Passive Dampingcited by 35
  23. 2019Defending against Whitebox Adversarial Attacks via Randomized Discretizationcited by 29
  24. 2020Improving the affordability of robustness training for DNNscited by 8
  25. 2021Towards Evaluating the Robustness of Neural Networks Learned by Transductioncited by 8
  26. 2020Defense Through Diverse Directionscited by 2

Built on by

Cited by year

Citing papers per year: 2022: 5; 2023: 4; 2024: 3; 2025: 2.

14 papers.

Sort:

  1. 2023Adversarial Illusions in Multi-Modal Embeddingscited by 28
  2. 2022On the Limitations of Stochastic Pre-processing Defensescited by 21
  3. 2022Game Theoretic Mixed Experts for Combinational Adversarial Machine Learningcited by 6
  4. 2022Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learningcited by 5
  5. 2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5
  6. 2024PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attackscited by 5
  7. 2024Responsible AI for Earth Observationcited by 4
  8. 2022Robustness Certification of Visual Perception Models via Camera Motion Smoothingcited by 3
  9. 2023Mitigating Adversarial Attacks in Federated Learning with Trusted Execution Environmentscited by 2
  10. 2024Certifying Adapters: Enabling and Enhancing the Certification of Classifier Adversarial Robustnesscited by 2
  11. 2023Pelta: Shielding Transformers to Mitigate Evasion Attacks in Federated Learningcited by 1
  12. 2023SEA: Shareable and Explainable Attribution for Query-based Black-box Attackscited by 0
2 more
  1. 2025Lattice Climber Attack: Adversarial attacks for randomized mixtures of classifierscited by 0
  2. 2025Towards Robust Protective Perturbation against DeepFake Face Swappingcited by 0