# Resisting Deep Learning Models Against Adversarial Attack Transferability via Feature Randomization

arXiv: https://arxiv.org/abs/2209.04930 · HTML: https://mlsanity.com/paper/2209.04930/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 43 references that are in the map.
- First posted on arXiv 11 Sep 2022.

## Builds on (most cited first, 20 of 20)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [Mitigating Adversarial Effects Through Randomization](https://mlsanity.com/paper/1711.01991/) (2017)
- [Adversarial Examples: Opportunities and Challenges](https://mlsanity.com/paper/1809.04790/) (2018)
- [Boosting the Transferability of Video Adversarial Examples via Temporal Translation](https://mlsanity.com/paper/2110.09075/) (2021)
- [Foolbox: A Python toolbox to benchmark the robustness of machine learning models](https://mlsanity.com/paper/1707.04131/) (2017)
- [Defending against adversarial attacks by randomized diversification](https://mlsanity.com/paper/1904.00689/) (2019)
- [A Survey of Machine Learning Techniques in Adversarial Image Forensics](https://mlsanity.com/paper/2010.09680/) (2020)
- [Adversarial Attacks to Machine Learning-Based Smart Healthcare Systems](https://mlsanity.com/paper/2010.03671/) (2020)
- [On the Transferability of Adversarial Examples Against CNN-Based Image Forensics](https://mlsanity.com/paper/1811.01629/) (2018)
- [Demystifying the Transferability of Adversarial Attacks in Computer Networks](https://mlsanity.com/paper/2110.04488/) (2021)
- [CNN-Based Detection of Generic Constrast Adjustment with JPEG Post-processing](https://mlsanity.com/paper/1805.11318/) (2018)
- [RAID: Randomized Adversarial-Input Detection for Neural Networks](https://mlsanity.com/paper/2002.02776/) (2020)
- [An Adversarial Attack Analysis on Malicious Advertisement URL Detection Framework](https://mlsanity.com/paper/2204.13172/) (2022)

## Built on by (most cited first, 5 of 5)

- [Federated Learning Under Attack: Exposing Vulnerabilities through Data Poisoning Attacks in Computer Networks](https://mlsanity.com/paper/2403.02983/) (2024)
- [Spritz-PS: Validation of Synthetic Face Images Using a Large Dataset of Printed Documents](https://mlsanity.com/paper/2304.02982/) (2023)
- [Fight Fire with Fire: Combating Adversarial Patch Attacks using Pattern-randomized Defensive Patches](https://mlsanity.com/paper/2311.06122/) (2023)
- [Adversarial Attacks Neutralization via Data Set Randomization](https://mlsanity.com/paper/2306.12161/) (2023)
- [Task-Agnostic Federation over Decentralized Data: Research Landscape and Visions](https://mlsanity.com/paper/2503.03140/) (2025)

## Abstract (arXiv)

In the past decades, the rise of artificial intelligence has given us the capabilities to solve the most challenging problems in our day-to-day lives, such as cancer prediction and autonomous navigation. However, these applications might not be reliable if not secured against adversarial attacks. In addition, recent works demonstrated that some adversarial examples are transferable across different models. Therefore, it is crucial to avoid such transferability via robust models that resist adversarial manipulations. In this paper, we propose a feature randomization-based approach that resists eight adversarial attacks targeting deep learning models in the testing phase. Our novel approach consists of changing the training strategy in the target network classifier and selecting random feature samples. We consider the attacker with a Limited-Knowledge and Semi-Knowledge conditions to undertake the most prevalent types of adversarial attacks. We evaluate the robustness of our approach using the well-known UNSW-NB15 datasets that include realistic and synthetic attacks. Afterward, we demonstrate that our strategy outperforms the existing state-of-the-art approach, such as the Most Powerful Attack, which consists of fine-tuning the network model against specific adversarial attacks. Finally, our experimental results show that our methodology can secure the target network and resists adversarial attack transferability by over 60%.