Pith. sign in

REVIEW 10 cited by

Ensemble Adversarial Training: Attacks and Defenses

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 1705.07204 v5 pith:KZG3KZYN submitted 2017-05-19 stat.ML cs.CRcs.LG

Florian Tramèr , Alexey Kurakin , Nicolas Papernot , Ian Goodfellow , Dan Boneh , Patrick McDaniel This is my paper
classification stat.MLcs.CRcs.LG
keywords adversarialtrainingattacksmodelsdataperturbationsblack-boxensemble
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against strong ones. As a result, we find that adversarial training remains vulnerable to black-box attacks, where we transfer perturbations computed on undefended models, as well as to a powerful novel single-step attack that escapes the non-smooth vicinity of the input data via a small random step. We further introduce Ensemble Adversarial Training, a technique that augments training data with perturbations transferred from other models. On ImageNet, Ensemble Adversarial Training yields models with strong robustness to black-box attacks. In particular, our most robust model won the first round of the NIPS 2017 competition on Defenses against Adversarial Attacks. However, subsequent work found that more elaborate black-box attacks could significantly enhance transferability and reduce the accuracy of our models.

Discussion (0). Sign in to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. OpenAlex reports about 1,109 citations worldwide. Full citation record

  1. Make me an Expert: Distilling from Generalist Black-Box Models into Specialized Models for Semantic Segmentation

    cs.CV 2025-08 conditional novelty 6.0 of 10

    ATGC selects the best input scale for a black-box open-vocabulary segmentation API, using DINOv2 attention entropy, improving one-hot-label distillation on Cityscapes and ACDC.

  2. Exploring Visual Prompting: Robustness Inheritance and Beyond

    cs.CV 2025-06 conditional novelty 6.0 of 10

    Visual prompts built on robust source models inherit adversarial robustness but lose standard accuracy; a max-pooling over logit blocks (PBL) improves accuracy while keeping most robustness.

  3. Foveation-Guided Dynamic Token Selection for Robust and Efficient Vision Transformers

    cs.CV 2026-07 conditional novelty 5.0 of 10

    FDT adds foveation and binary fixation modules to DeiT so multi-scale tokens are selected dynamically in one pass, improving ImageNet100 accuracy, MACs, and robustness without adversarial training.

  4. Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition

    cs.CV 2025-09 conditional novelty 5.0 of 10

    A local-mixing and logit-optimization attack improves transferability of adversarial examples for remote sensing object recognition, outperforming 12 prior methods on two benchmarks.

  5. Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation

    cs.CV 2025-07 conditional novelty 5.0 of 10

    A Segmented Gaussian Pyramid transformation that averages gradients over three downsampled scales improves black-box adversarial transferability against defense models.

  6. DUMB and DUMBer: Is Adversarial Training Worth It in the Real World?

    cs.CR 2025-06 conditional novelty 5.0 of 10

    Across 240 model configurations and 13 attacks, adaptive and curriculum adversarial training give the largest robustness gains, but 20.53% of evaluations show negative gains, mostly under mismatched source-target mode...

  7. Enhancing Adversarial Transferability through Block Stretch and Shrink

    cs.LG 2025-11 reject novelty 4.0 of 10

    A block stretch-and-shrink input transformation improves black-box adversarial transferability in experiments on 1000 ImageNet images, but the submitted manuscript contains missing figures and an abstract describing a...

  8. DeepDefense: Robust Learning via Layer-Wise Gradient-Feature Alignment

    cs.LG 2025-11 reject novelty 4.0 of 10

    A layer-wise gradient-feature alignment regularizer is claimed to make neural networks robust to adversarial perturbations, with empirical gains over a PGD-based adversarial training baseline.

  9. Improving Adversarial Robustness Through Adaptive Learning-Driven Multi-Teacher Knowledge Distillation

    cs.CV 2025-07 conditional novelty 4.0 of 10

    A multi-teacher adversarial robustness distillation method (MTKD-AR) trains a clean-data student using cosine-similarity-weighted logits from adversarially trained teachers, reporting improved robustness on MNIST and ...

  10. PRM-Free Security Alignment of Large Models via Red Teaming and Adversarial Training

    cs.CR 2025-07 reject novelty 3.0 of 10

    A PRM-free alignment pipeline combining genetic algorithm red teaming and multi-objective adversarial training is claimed to beat PRM-based methods at 61% lower cost, but the experiments are unverifiable.

Pith tools