Research map / Adversarial robustness and security / Attacks on text and graphs
Stop Diverse OOD Attacks: Knowledge Ensemble for Reliable Defense
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Reliable Defense Ensemble (REE), combining Dynamic Synergy Amplification, a Kernel Anomaly Smoothing Detection module, and RL-tuned inter-model communication to defend against OOD adversarial attacks on CIFAR and ImageNet models.
Problem
Using ensemble knowledge of multiple models to defend against out-of-distribution adversarial attacks that evade static or adaptive defenses.
Approach
Treats an ensemble of models as a collaborative swarm: weights are reallocated per a quantified threat index (DSA), a Gaussian-kernel mean-embedding detector (KASD) flags anomalous attack distributions, and reinforcement learning tunes communication and consensus among models.
Key results
- On CIFAR-10 with ResNet-18, REE reaches 61.80% PGD20 and 68.27% AutoAttack robust accuracy, best among compared methods in Table 1.
- In Table 2 ensemble comparison, REE is top or near-top under PGD, C&W, AA, CAA, and MORA attacks versus ADP, Dverage, GAL, and TRS+.
- ViT-B-16 on CIFAR-10 improves from 34.53% without defense to 56.99% after REE training.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use REE instead of RNA | ResNet-18 · CIFAR-10, PGD20 | robustness: 60.69 -> 61.80 | Helped |
| Use REE instead of RNA | WRN32-10 · CIFAR-10, PGD20 | robustness: 63.34 -> 66.36 | Helped |
| Use REE instead of RNA | ResNet-18 · CIFAR-100, AutoAttack | robustness: 42.12 -> 45.72 | Helped |
| Use REE instead of RNA | WRN32-10 · CIFAR-100, AutoAttack | robustness: 42.43 -> 43.29 | Helped |
| Train ViT-B-16 with REE | ViT-B-16 · CIFAR-10 | accuracy: 34.53% -> 56.99% | Helped |
| Train ViT-L-16 with REE | ViT-L-16 · CIFAR-100 | accuracy: 32.24% -> 53.77% | Helped |
| Increase perturbation budget proportion (ablation) | REE · Ablation study | accuracy | Hurt |
| Increase perturbation budget proportion (ablation) | REE · Ablation study | robustness | Hurt |
| Increase training epochs (ablation) | REE · Ablation study | accuracy | Helped |
| Increase training epochs (ablation) | REE · Ablation study | robustness | Helped |
| Remove one or more REE components (ablation) | REE · Ablation study | performance | Hurt |
| Set hyperparameters to (1.0, 2.0) (ablation) | REE on ConvNeXt · ConvNeXt robustness analysis | robustness improvement | Helped |
Surprising findings
- Under the C&W attack on WRN32-10 (Table 1), REE is lower than RNA (83.61 vs 85.68), so it is not uniformly best.
Limitations
- Core components (DSA, KASD) are described largely with informal formulas and unspecified hyperparameters, making replication difficult.
- Several results (e.g., C&W on WRN32-10) do not beat the strongest baseline uniformly.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: RobustBench CIFAR-10 CIFAR-100
Metrics: robust accuracy standard accuracy
Baselines: BN LN RNA ADP Dverage GAL TRS+ FDA AdRob
Builds on: adversarial training deep kernel learning RNA C2ST
Closest papers by meaning
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.85)
- Learning Diverse Attacks on Large Language Models for Robust Red-Teaming and Safety Tuning (ICLR 2025 · similarity 0.83)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.82)
- Two is Better than One: Efficient Ensemble Defense for Robust and Compact Models (CVPR 2025 · similarity 0.82)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.82)
- Adapting to Evolving Adversaries with Regularized Continual Robust Training (ICML 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.