Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Robustness via Runtime Masking and Cleansing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add runtime masking and cleansing (local adaptation on precomputed adversarial neighbors) at test time | regularly trained ResNet-32 · CIFAR-10 train-time white-box, PGD attack | robustness (%): 8.5 -> 86.7 | Helped |
| add runtime masking and cleansing on top of PGD adversarial training | PGD adversarially trained ResNet-32 · CIFAR-10 train-time white-box, PGD attack | robustness (%): 43.6 -> 81.1 | Helped |
| use RMC instead of DeepNN/WebNN runtime defenses | ResNet-32 regular training · CIFAR-10 train-time white-box, PGD attack | robustness (%): WebNN 47.8, DeepNN 9.2 -> RMC 86.7 | Helped |
| apply RMC to a regularly trained ResNet-152 | ImageNet targeted white-box attack eps=16/255 · ImageNet | robustness (%): 5.2 -> 55.9 | Helped |
| reduce D0 to a size of 10^6 for WebNN-style defense on ImageNet | WebNN baseline · ImageNet | robustness (%) | Hurt |
| add runtime local adaptation (masking) and cleansing vs. cleansing-only (non-masking) ablation (ablation) | RMC · CIFAR-10 PGD-Skip | robustness (%): non-masking 26.2 at p=1000 vs hindsight adversarial training 16.4 | Helped |
| increase size of D0 (precomputed adversarial examples) (ablation) | RMC · CIFAR-10 white-box | robustness (%) | Helped |
| restrict D0 to adversarial examples from a single attack type matching the attacker vs. leave-one-out D0 excluding that attack (ablation) | RMC D0 composition · CIFAR-10 white-box FGSM | robustness (%): Single-Attack 85.3 vs Leave-One-Out 63.1 | Mixed |
| increase K (number of nearest neighbors) in local adaptation (ablation) | RMC · CIFAR-10 white-box | robustness | Helped |
| recompute adversarial examples in D0 with adapted weights (RMC+) vs. RMC (ablation) | RMC under PGD-Skip-Delayed · CIFAR-10 PGD-Skip-Delayed | robustness (%): RMC+ 51 at q=50 for p=50, delta=0.5 | Helped |
| PGD-NN defense-aware attack that manipulates nearest-neighbor selection | DeepNN and WebNN baselines · CIFAR-10 PGD-NN | robustness (%): WebNN 48.6 -> 1.5; DeepNN 8 -> 11.4 (attack) | Hurt |
Closest papers by meaning
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.90)
- Robust Models are less Over-Confident (NeurIPS 2022 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM (CVPR 2024 · similarity 0.89)
- Robust NAS under adversarial training: benchmark, theory, and beyond (ICLR 2024 · similarity 0.88)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.