Research map / Adversarial robustness and security / Certified and empirical robustness
Barrage of Random Transforms for Adversarially Robust Defense
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BaRT with 5 randomly selected transforms instead of plain ResNet50 | ResNet50 · ImageNet validation, PGD, ε=16 | Top-1 accuracy: 0.0 -> 16 | Helped |
| Use BaRT with 5 randomly selected transforms instead of plain ResNet50 | ResNet50 · ImageNet validation, PGD, ε=16 | Top-5 accuracy: 0.0 -> 51 | Helped |
| Use BaRT with 5 randomly selected transforms instead of plain ResNet50 | ResNet50 · ImageNet validation, clean images | Top-1 accuracy: 76 -> 65 | Hurt |
| Use BaRT with 5 randomly selected transforms instead of plain ResNet50 | ResNet50 · ImageNet validation, clean images | Top-5 accuracy: 93 -> 85 | Hurt |
| Increase the number of randomly applied transforms from k=5 to k=10 (ablation) | ResNet50-BaRT · ImageNet validation, PGD, ε=16 | Top-1 accuracy: 16 -> 36 | Helped |
| Increase the number of randomly applied transforms from k=5 to k=10 (ablation) | ResNet50-BaRT · ImageNet validation, PGD, ε=16 | Top-5 accuracy: 51 -> 57 | Helped |
| Increase the number of randomly applied transforms from k=5 to k=10 (ablation) | ResNet50-BaRT · ImageNet validation, clean images | Top-1 accuracy: 65 -> 65 | No clear effect |
| Increase the number of randomly applied transforms from k=5 to k=10 (ablation) | ResNet50-BaRT · ImageNet validation, clean images | Top-5 accuracy: 85 -> 85 | No clear effect |
| Increase the number of transforms applied at test time (ablation) | ResNet50-BaRT · ImageNet validation | Top-1 and Top-5 accuracy | Mixed |
| Increase EoT steps from 10 to 40 for PGD (ablation) | Attack against ResNet50-BaRT · ImageNet validation, varying ε | Top-1 and Top-5 accuracy under attack | Hurt |
| Use Medoid over Transformations instead of mean-gradient EoT (ablation) | PGD attack against ResNet50-BaRT · ImageNet validation, varying ε | Top-1 and Top-5 accuracy under attack | No clear effect |
Closest papers by meaning
- Demystifying the Adversarial Robustness of Random Transformation Defenses (ICML 2022 · similarity 0.93)
- Adversarial Robustness via Deformable Convolution with Stochasticity (ICML 2025 · similarity 0.91)
- On the Limitations of Stochastic Pre-processing Defenses (NeurIPS 2022 · similarity 0.89)
- Enhancing Transformation-Based Defenses Against Adversarial Attacks with a Distribution Classifier (ICLR 2020 · similarity 0.89)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.88)
- Random Entangled Tokens for Adversarially Robust Vision Transformer (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.