mlsanityData to 7 Oct 2026

Understanding and Improving Ensemble Adversarial Defense

arXiv 2310.18477 ↗First posted 27 Oct 2023cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

The strategy of ensemble has become popular in adversarial defense, which trains multiple base classifiers to defend against adversarial attacks in a cooperative manner. Despite the empirical success, theoretical explanations on why an ensemble of adversarially trained classifiers is more robust than single ones remain unclear. To fill in this gap, we develop a new error theory dedicated to understanding ensemble adversarial defense, demonstrating a provable 0-1 loss reduction on challenging sample sets in an adversarial defense scenario. Guided by this theory, we propose an effective approach to improve ensemble adversarial defense, named interactive global adversarial training (iGAT). The proposal includes (1) a probabilistic distributing rule that selectively allocates to different base classifiers adversarial examples that are globally challenging to the ensemble, and (2) a regularization term to rescue the severest weaknesses of the base classifiers. Being tested over various existing ensemble adversarial defense techniques, iGAT is capable of boosting their performance by increases up to 17% evaluated using CIFAR10 and CIFAR100 datasets under both white-box and black-box attacks.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 38 of its 55 references that are in the map. First posted on arXiv 27 Oct 2023.

Builds on

38 of 55 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Wide Residual Networkscited by 3,057
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  11. 2018Robustness May Be at Odds with Accuracycited by 873
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
26 more
  1. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  3. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  4. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  5. 2018Lipschitz regularity of deep neural networks: analysis and efficient estimationcited by 413
  6. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  7. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  8. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  9. 2019Simple Black-box Adversarial Attackscited by 249
  10. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  11. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  12. 2018Robustness via curvature regularization, and vice versacited by 174
  13. 2020Understanding and Mitigating the Tradeoff Between Robustness and Accuracycited by 148
  14. 2019Adversarial Robustness through Local Linearizationcited by 146
  15. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  16. 2016Topology and Geometry of Half-Rectified Network Optimizationcited by 102
  17. 2020Do Wider Neural Networks Really Help Adversarial Robustness?cited by 79
  18. 2020DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensemblescited by 73
  19. 2023A Unified Theory of Diversity in Ensemble Learningcited by 71
  20. 2019Improving Adversarial Robustness of Ensembles with Diversity Trainingcited by 69
  21. 2019Robustness to Adversarial Perturbations in Learning from Incomplete Datacited by 49
  22. 2018Improving the Generalization of Adversarial Training with Domain Adaptationcited by 48
  23. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 37
  24. 2019A Survey of Black-Box Adversarial Attacks on Computer Vision Modelscited by 36
  25. 2020Label Confusion Learning to Enhance Text Classification Modelscited by 16
  26. 2022Adversarial Ensemble Training by Jointly Learning Label Dependencies and Member Modelscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 5; 2025: 7; 2026: 2.

14 papers.

Sort:

  1. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 6
  2. 2024Adversarial Training: A Surveycited by 6
  3. 2024Enhancing Adversarial Attacks via Parameter Adaptive Adversarial Attackcited by 2
  4. 2024Impact of Regularization on Calibration and Robustness: from the Representation Space Perspectivecited by 1
  5. 2025Two is Better than One: Efficient Ensemble Defense for Robust and Compact Modelscited by 1
  6. 2024Hidden Activations Are Not Enough: A General Approach to Neural Network Predictionscited by 0
  7. 2025Lightweight Defense Against Adversarial Attacks in Time Series Classificationcited by 0
  8. 2025Towards provable probabilistic safety for scalable embodied AI systemscited by 0
  9. 2025Boosting the Robustness-Accuracy Trade-off of SNNs by Robust Temporal Self-Ensemblecited by 0
  10. 2025Learning from Peers: Collaborative Ensemble Adversarial Trainingcited by 0
  11. 2025Tuning for Two Adversaries: Enhancing the Robustness Against Transfer and Query-Based Attacks using Hyperparameter Tuningcited by 0
  12. 2025Defense That Attacks: How Robust Models Become Better Attackerscited by 0
2 more
  1. 2026Poisoning the Inner Prediction Logic of Graph Neural Networks for Clean-Label Backdoor Attackscited by 0
  2. 2026Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attackscited by 0