Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensembles
Not on the map. Why?
Abstract (arXiv)
We propose a test-time defense mechanism against adversarial attacks: imperceptible image perturbations that significantly alter the predictions of a model. Unlike existing methods that rely on feature filtering or smoothing, which can lead to information loss, we propose to "combat noise with noise" by leveraging stochastic resonance to enhance robustness while minimizing information loss. Our approach introduces small translational perturbations to the input image, aligns the transformed feature embeddings, and aggregates them before mapping back to the original reference image. This can be expressed in a closed-form formula, which can be deployed on diverse existing network architectures without introducing additional network modules or fine-tuning for specific attack types. The resulting method is entirely training-free, architecture-agnostic, and attack-agnostic. Empirical results show state-of-the-art robustness on image classification and, for the first time, establish a generic test-time defense for dense prediction tasks, including stereo matching and optical flow, highlighting the method's versatility and practicality. Specifically, relative to clean (unperturbed) performance, our method recovers up to 68.1% of the accuracy loss on image classification, 71.9% on stereo matching, and 29.2% on optical flow under various types of adversarial attacks.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 48 of its 66 references that are in the map. First posted on arXiv 3 Oct 2025.
Builds on
48 of 66 references.
References · 48
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2016Wide Residual Networkscited by 3,057
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2020RAFT: Recurrent All-Pairs Field Transforms for Optical Flowcited by 2,385
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2017The 2017 DAVIS Challenge on Video Object Segmentationcited by 942
- 2016Universal adversarial perturbationscited by 774
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
36 more
- 2018Pyramid Stereo Matching Networkcited by 486
- 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
- 2018Adversarial Logit Pairingcited by 224
- 2018Why do deep convolutional networks generalize so poorly to small image transformations?cited by 198
- 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
- 2017The Space of Transferable Adversarial Examplescited by 156
- 2018Curriculum Adversarial Trainingcited by 89
- 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
- 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
- 2022Enhancing Adversarial Training with Second-Order Statistics of Weightscited by 42
- 2019Attacking Optical Flowcited by 41
- 2018Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networkscited by 38
- 2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
- 2020Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspectivecited by 35
- 2019Batch Normalization is a Cause of Adversarial Vulnerabilitycited by 28
- 2019Towards Robust Image Classification Using Sequential Attention Modelscited by 27
- 2021Enhancing Adversarial Robustness via Test-time Transformation Ensemblingcited by 27
- 2022Removing Batch Normalization Boosts Adversarial Trainingcited by 24
- 2021CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selectioncited by 21
- 2020Stereopagnosia: Fooling Stereo Networks with Adversarial Perturbationscited by 19
- 2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 19
- 2021Stereoscopic Universal Perturbations across Different Architectures and Datasetscited by 17
- 2022A Perturbation-Constrained Adversarial Attack for Evaluating the Robustness of Optical Flowcited by 16
- 2023Feature Separation and Recalibration for Adversarial Robustnesscited by 16
- 2021Towards Understanding Adversarial Robustness of Optical Flow Networkscited by 15
- 2023AugUndo: Scaling Up Augmentations for Monocular Depth Completion and Estimationcited by 15
- 2023Sub-token ViT Embedding via Stochastic Resonance Transformerscited by 9
- 2024Robust Decentralized Learning with Local Updates and Gradient Trackingcited by 8
- 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
- 2021Simple Post-Training Robustness Using Test Time Augmentations and Random Forestcited by 4
- 2023Test-time Detection and Repair of Adversarial Samples via Masked Autoencodercited by 4
- 2019Translation Insensitive CNNscited by 3
- 2021Towards Adversarially Robust and Domain Generalizable Stereo Matching by Rethinking DNN Feature Backbonescited by 3
- 2024Attack on Scene Flow using Point Cloudscited by 1
- 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.