mlsanityData to 14 Oct 2026

Randomness in ML Defenses Helps Persistent Attackers and Hinders Evaluators

arXiv 2302.13464 ↗First posted 27 Feb 2023cs.LG cs.CRcited by 5

Not on the map. Why?

Abstract (arXiv)

It is becoming increasingly imperative to design robust ML defenses. However, recent work has found that many defenses that initially resist state-of-the-art attacks can be broken by an adaptive adversary. In this work we take steps to simplify the design of defenses and argue that white-box defenses should eschew randomness when possible. We begin by illustrating a new issue with the deployment of randomized defenses that reduces their security compared to their deterministic counterparts. We then provide evidence that making defenses deterministic simplifies robustness evaluation, without reducing the effectiveness of a truly robust defense. Finally, we introduce a new defense evaluation framework that leverages a defense's deterministic nature to better evaluate its adversarial robustness.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 19 of its 27 references that are in the map. First posted on arXiv 27 Feb 2023.

Builds on

19 of 27 references.

References · 19

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  5. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  6. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  7. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  8. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  9. 2022Diffusion Models for Adversarial Purificationcited by 476
  10. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  11. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 405
  12. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
7 more
  1. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  2. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 105
  3. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 60
  4. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  5. 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
  6. 2022On the Limitations of Stochastic Pre-processing Defensescited by 21
  7. 2019Benchmarking Adversarial Robustnesscited by 15

Built on by

Cited by year

Citing papers per year: 2023: 2; 2024: 2; 2025: 1.

5 papers.

  1. 2023Are aligned neural networks adversarially aligned?cited by 315
  2. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
  3. 2023Universal Adversarial Defense in Remote Sensing Based on Pre-trained Denoising Diffusion Modelscited by 5
  4. 2025FlowPure: Continuous Normalizing Flows for Adversarial Purificationcited by 2
  5. 2024Certified Robustness to Clean-Label Poisoning Using Diffusion Denoisingcited by 1