Research map / Adversarial robustness and security / Certified and empirical robustness
Demystifying the Adversarial Robustness of Random Transformation Defenses
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace EoT with the paper's linear-loss, SGM, and AggMo attack | RT defense · Imagenette | adversarial accuracy: 70.79 -> 6.34 | Hurt |
| Replace EoT with the paper's linear-loss, SGM, and AggMo attack | RT defense · CIFAR-10 | adversarial accuracy: 33.83 -> 29.91 | Hurt |
| Use adversarial training | RT defense · CIFAR-10 | adversarial accuracy: 29.91 ± 0.35 -> 41.30 ± 0.49 | Helped |
| Use adversarial training | RT defense · Imagenette | adversarial accuracy: 6.34 ± 0.35 -> 8.68± 0.52 | No clear effect |
| Use BPDA instead of exact gradients for differentiable transforms | BaRT (only differentiable) · Imagenette | adversarial accuracy: 26.06 ± 0.21 -> 65.28 ± 0.25 | Hurt |
| Use the combined exact-gradient/BPDA approach instead of BPDA alone | BaRT (full) · Imagenette | adversarial accuracy: 52.32 ± 0.22 -> 25.24 ± 0.16 | Hurt |
| Use linear loss on mean logits instead of the EoT objective (ablation) | RT defense attack · Imagenette | adversarial accuracy: 73.36 ± 0.37 -> 66.11 ± 0.58 | Hurt |
| Add SGM to the linear-logits attack (ablation) | RT defense attack · Imagenette | adversarial accuracy: 66.11 ± 0.58 -> 63.75 ± 0.21 | Hurt |
| Add momentum boosting to the linear-logits attack (ablation) | RT defense attack · Imagenette | adversarial accuracy: 66.11 ± 0.58 -> 72.66 ± 0.50 | Mixed |
| Add LinBP to the linear-logits attack (ablation) | RT defense attack · Imagenette | adversarial accuracy: 66.11 ± 0.58 -> 70.57 ± 0.32 | Mixed |
| Add targeted attack to the linear-logits attack (ablation) | RT defense attack · Imagenette | adversarial accuracy: 66.11 ± 0.58 -> 68.70 ± 0.34 | Mixed |
| Fix the transform permutation across attack samples instead of resampling it (ablation) | EoT attack on RT defense · Imagenette | adversarial accuracy: 70.79 -> 51.44 | Hurt |
Closest papers by meaning
- Barrage of Random Transforms for Adversarially Robust Defense (CVPR 2019 · similarity 0.93)
- Adversarial Robustness via Deformable Convolution with Stochasticity (ICML 2025 · similarity 0.90)
- Benchmarking Adversarial Robustness on Image Classification (CVPR 2020 · similarity 0.89)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.87)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.87)
- Random Entangled Tokens for Adversarially Robust Vision Transformer (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.