Research map / Adversarial robustness and security / Certified and empirical robustness
Mitigating Adversarial Effects Through Randomization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add random resizing and random padding at inference | ImageNet classifiers · ImageNet validation, vanilla attack, DeepFool | top-1 accuracy: 0% -> 98.3% | Helped |
| Add random resizing and random padding to ensemble adversarial training | ens-adv-Inception-ResNet-v2 · NIPS 2017 adversarial examples defense challenge | normalized score: 0.773 -> 0.924 | Helped |
| Use random resizing and random padding | ImageNet classifiers · ImageNet validation clean images | top-1 accuracy: 100% -> 99.2% | Hurt |
| Use an ensemble of predefined randomization patterns for the attack instead of a single target pattern | Randomization defense · ImageNet validation, ensemble-pattern attack, C&W | top-1 accuracy: 99.1% -> 86.1% | Hurt |
| Add random brightness augmentation alone instead of the proposed resizing and padding layers (ablation) | ImageNet classifiers · ImageNet validation, vanilla attack, DeepFool | top-1 accuracy: 98.3% -> 79.4% | Hurt |
| Combine random brightness augmentation with random resizing and padding (ablation) | Randomization defense · ImageNet validation, vanilla attack, FGSM-2 | top-1 accuracy: 65.1% -> 67.0%; 95.7% -> 95.8% | Mixed |
| Replace random brightness with random saturation augmentation alone (ablation) | ImageNet classifiers · ImageNet validation, vanilla attack | top-1 accuracy | Hurt |
| Combine random saturation augmentation with random resizing and padding (ablation) | Randomization defense · ImageNet validation, vanilla attack | top-1 accuracy | Mixed |
| Replace random resizing and padding with random hue augmentation alone (ablation) | ImageNet classifiers · ImageNet validation, vanilla attack | top-1 accuracy | Hurt |
| Combine random hue augmentation with random resizing and padding (ablation) | Randomization defense · ImageNet validation, vanilla attack | top-1 accuracy | Mixed |
| Replace random resizing and padding with random contrast augmentation alone (ablation) | ImageNet classifiers · ImageNet validation, vanilla attack | top-1 accuracy | Hurt |
| Combine random contrast augmentation with random resizing and padding (ablation) | Randomization defense · ImageNet validation, vanilla attack | top-1 accuracy | Mixed |
Closest papers by meaning
- Adversarial Robustness via Deformable Convolution with Stochasticity (ICML 2025 · similarity 0.90)
- Theoretical evidence for adversarial robustness through randomization (NeurIPS 2019 · similarity 0.90)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.87)
- Learning Randomized Algorithms with Transformers (ICLR 2025 · similarity 0.87)
- Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.87)
- Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.