Pith. sign in

REVIEW 24 cited by

Mitigating Adversarial Effects Through Randomization

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 1711.01991 v3 pith:CAXPHNVX submitted 2017-11-06 cs.CV

Cihang Xie , Jianyu Wang , Zhishuai Zhang , Zhou Ren , Alan Yuille This is my paper · ORCID
classification cs.CV
keywords adversarialrandomizationdefenserandomimagesmethodadditionalchallenge
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 24 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. TRAIL: Transferable Robust Adversarial Images via Latent diffusion

    cs.CV 2025-05 conditional novelty 7.0 of 10

    TRAIL adapts a latent diffusion model to a target image during the attack, then uses the adapted model to generate transferable adversarial images with minimal visual change.

  2. ANNIE: Be Careful of Your Robots

    cs.AI 2025-09 conditional novelty 6.0 of 10

    The authors build a safety-centered benchmark and attack method that induces vision-language-action robot policies to violate ISO-based safety rules in a majority of tested episodes.

  3. Kill Two Birds with One Stone! Trajectory enabled Unified Online Detection of Adversarial Examples and Backdoor Attacks

    cs.CR 2025-06 conditional novelty 6.0 of 10

    UniGuard detects both adversarial examples and backdoor-triggered inputs at inference time by treating each input's layer-by-layer path as a time series and flagging anomalies.

  4. Adversarial Attacks and Detection in Visual Place Recognition for Safer Robot Navigation

    cs.CV 2025-06 conditional novelty 6.0 of 10

    Simulated adversarial attack detectors with moderate accuracy (75% true positive, up to 25% false positive) reduce mean along-track localization error by about 50% in visual place recognition navigation, and reference...

  5. Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation

    cs.CV 2025-06 conditional novelty 6.0 of 10

    DAC and BP-DAC generate 'unsourced' adversarial CAPTCHAs from semantic prompts and report transfer attack success rates above 95% on ImageNet classifiers in black-box settings.

  6. SHIELD: Secure Hypernetworks for Incremental Expansion Learning Defense

    cs.LG 2025-06 conditional novelty 6.0 of 10

    SHIELD uses a hypernetwork with IBP training and a new Interval MixUp technique to achieve certified robustness in continual learning, reporting state-of-the-art adversarial accuracy on MNIST, CIFAR-100, and miniImage...

  7. Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Spa-VLM crafts paired adversarial images and misleading texts to poison RAG-based VLM knowledge bases, reaching attack success rates above 0.8 with just five injected entries.

  8. OODFace: Benchmarking Robustness of Face Recognition under Common Corruptions and Appearance Variations

    cs.CV 2024-12 conditional novelty 6.0 of 10

    OODFace builds LFW-C/V, CFP-C/V, and YTF-C/V to show that face recognition models and commercial APIs lose significant accuracy under common corruptions and appearance variations.

  9. Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense

    cs.LG 2024-11 conditional novelty 6.0 of 10

    Adaptive attacks reduce the robust accuracy of the 'Ensemble Everything Everywhere' defense to 11% on CIFAR-10 and 14% on CIFAR-100 under an l-infinity bound of 8/255.

  10. Smaug: Fixing Failure Modes of Preference Optimisation with DPO-Positive

    cs.CL 2024-02 conditional novelty 6.0 of 10

    DPOP is a new loss function that prevents DPO from lowering preferred response likelihoods and outperforms standard DPO on diverse datasets, MT-Bench, and enables Smaug-72B to exceed 80% on the Open LLM Leaderboard.

  11. Theory of Continual Learning Against Data Poisoning Attacks

    cs.LG 2026-06 unverdicted novelty 5.0 of 10

    Establishes that no defense works against linear-proportion poisoning with unbounded noise in regularization-based continual learning and proposes verification and robust defenses for infrequent or bounded attacks.

  12. Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition

    cs.CV 2025-09 conditional novelty 5.0 of 10

    A local-mixing and logit-optimization attack improves transferability of adversarial examples for remote sensing object recognition, outperforming 12 prior methods on two benchmarks.

  13. ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformers

    cs.CV 2025-08 conditional novelty 5.0 of 10

    ViT-EnsembleAttack augments each ViT surrogate with three randomized strategies, tunes their parameters by Bayesian optimization, and ensembles them to substantially improve adversarial transferability.

  14. Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation

    cs.CV 2025-07 conditional novelty 5.0 of 10

    A Segmented Gaussian Pyramid transformation that averages gradients over three downsampled scales improves black-box adversarial transferability against defense models.

  15. MalGuard: Towards Real-Time, Accurate, and Actionable Detection of Malicious Packages in PyPI Ecosystem

    cs.CR 2025-06 conditional novelty 5.0 of 10

    MalGuard uses graph centrality, LLM filtering, and LIME to detect malicious PyPI packages with lightweight ML models and explainable outputs.

  16. Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking

    cs.CV 2025-05 conditional novelty 5.0 of 10

    A diffusion-based input purification module with pixel, semantic, and structural losses restores most tracking performance lost to a white-box adversarial attack, tested on three trackers.

  17. Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion

    cs.CV 2025-05 conditional novelty 5.0 of 10

    FSA combines Fourier high-frequency augmentation with Gaussian pyramid gradient fusion to boost adversarial transferability against defended black-box models.

  18. DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection

    cs.CR 2025-05 reject novelty 5.0 of 10

    DP-TRAE combines a transferable white-box adversarial initialization with a memory-augmented superpixel query attack and reversible embedding to mislead black-box image classifiers while allowing image recovery.

  19. Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles

    cs.LG 2026-08 conditional novelty 4.0 of 10

    Training traffic sign classifiers with two frozen text-prototype losses, built from VLM-generated descriptions and class names, improves accuracy under shadows, natural light, and printed patches, with no inference-ti...

  20. Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition

    cs.CV 2025-05 conditional novelty 4.0 of 10

    ASL-PAR creates universal adversarial noise using label and semantic perturbation, dropping PromptPAR's mean accuracy by up to 40 points on standard PAR benchmarks, while a filter-and-prompt defense restores most of the drop.

  21. Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems

    cs.RO 2025-05 conditional novelty 4.0 of 10

    Adversarial attacks shift OpenPilot distance estimates by tens of meters and cut YOLOv8 stop sign recall sharply, while tested defenses trade off gains against new failure modes.

  22. Towards Adversarially Robust Deep Metric Learning

    cs.LG 2025-01 conditional novelty 4.0 of 10

    Ensemble Adversarial Training with data-split diversity improves PGD robustness for deep metric learning models over adapted classification defenses, but the evaluation has important gaps.

  23. BlurNet: Defense by Filtering the Feature Maps

    cs.LG 2019-08 conditional novelty 4.0 of 10

    Low-pass filtering or total-variation regularization of first-layer feature maps reduces RP2 adversarial sticker attack success on LISA traffic-sign classifiers from 90% to 20% worst-case, with a 5-14% clean accuracy drop.

  24. RCR-AF: Enhancing Model Generalization via Rademacher Complexity Reduction Activation Function

    cs.LG 2025-07 reject novelty 2.0 of 10

    RCR-AF, a clipped scaled-softplus activation, is claimed to improve CIFAR-10 accuracy and robustness, but the evidence is undermined by test-set tuning and a flawed complexity derivation.

Pith tools