mlsanityData to 7 Oct 2026

A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense

arXiv 2402.07183 ↗First posted 11 Feb 2024cs.AIcited by 3

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are well known to be vulnerable to adversarial examples (AEs). In previous studies, the use of models encrypted with a secret key was demonstrated to be robust against white-box attacks, but not against black-box ones. In this paper, we propose a novel method using the vision transformer (ViT) that is a random ensemble of encrypted models for enhancing robustness against both white-box and black-box attacks. In addition, a benchmark attack method, called AutoAttack, is applied to models to test adversarial robustness objectively. In experiments, the method was demonstrated to be robust against not only white-box attacks but also black-box ones in an image classification task on the CIFAR-10 and ImageNet datasets. The method was also compared with the state-of-the-art in a standardized benchmark for adversarial robustness, RobustBench, and it was verified to outperform conventional defenses in terms of clean accuracy and robust accuracy.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 63 of its 77 references that are in the map. First posted on arXiv 11 Feb 2024.

Builds on

63 of 77 references.

References · 63

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2016Adversarial Machine Learning at Scalecited by 934
38 more
  1. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  2. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  3. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  4. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  5. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  6. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  7. 2019Adversarial Training for Free!cited by 638
  8. 2017One pixel attack for fooling deep neural networkscited by 579
  9. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  10. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  11. 2017Countering Adversarial Images using Input Transformationscited by 517
  12. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  13. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  14. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  15. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  16. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  17. 2018Certified Defenses against Adversarial Examplescited by 305
  18. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  19. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  20. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  21. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  22. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  23. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  24. 2017Generative Adversarial Perturbationscited by 153
  25. 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
  26. 2019Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Trainingcited by 95
  27. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  28. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  29. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  30. 2020DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensemblescited by 73
  31. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  32. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  33. 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 42
  34. 2018Unrestricted Adversarial Examplescited by 40
  35. 2018Encryption-then-Compression Systems using Grayscale-based Image Encryption for JPEG Imagescited by 33
  36. 2022An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applicationscited by 29
  37. 2017Attacking the Madry Defense Model with L1-based Adversarial Examplescited by 21
  38. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18

50 most cited of 63 All 63 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 1; 2026: 1.

3 papers.

  1. 2025A Privacy-Preserving Semantic-Segmentation Method Using Domain-Adaptation Techniquecited by 1
  2. 2024Privacy-Preserving Vision Transformer Using Images Encrypted with Restricted Random Permutation Matricescited by 0
  3. 2026Privacy-Preserving Object Detection for Vision Transformer-Based Modelscited by 0