[Paper Review] Mitigating Adversarial Effects Through Randomization

Cihang Xie, Jianyu Wang+3 more|arXiv (Cornell University)|Nov 6, 2017

Adversarial Robustness in Machine LearningComputer Science26 references195 citations

TL;DR

The paper proposes inference-time randomization (random resizing and random padding) to defend CNNs against adversarial examples, achieving strong results especially against iterative attacks and boosting defenses when combined with adversarial training.

ABSTRACT

Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.

Motivation & Objective

• Motivate robust classification under adversarial perturbations for CNNs.
• Introduce a lightweight, training-free defense via inference-time randomization.
• Evaluate defense across multiple architectures and attack types on ImageNet-scale data.
• Show compatibility with adversarial training and competitive performance in a defense challenge.

Proposed method

• Add two randomization layers at inference: random resizing to a size in [299,331) and random zero-padding to 331×331×3.
• No retraining or fine-tuning required; minimal additional computation.
• Demonstrate that randomization disrupts adversarial perturbations, especially for iterative attacks, due to transferability loss across random patterns.
• Combine randomization with adversarial training to enhance robustness against single-step attacks.
• Evaluate on ImageNet-scale networks (Inception-v3, ResNet-101, Inception-ResNet-v2, ens-adv-Inception-ResNet-v2) using FGSM, DeepFool, and Carlini & Wagner attacks.

Experimental results

Research questions

• RQ1 Does inference-time randomization reduce the transferability of adversarial perturbations across varied patterns?
• RQ2 How does the method perform against single-step versus iterative attacks?
• RQ3 Is the randomization approach compatible with existing adversarial training and network architectures?
• RQ4 What is the impact on clean image accuracy?
• RQ5 How does the method perform in large-scale benchmarks like NIPS 2017 defense challenge?

Key findings

• Randomization layers significantly mitigate adversarial effects for both single-step and iterative attacks, especially under iterative attacks.
• Combining randomization with ensemble adversarial training yields strong robustness, e.g., top-1 accuracy remains high across attacks.
• On clean images, randomization causes negligible accuracy degradation (e.g., small drops across architectures).
• In NIPS 2017 defense challenge, randomization plus ens-adv-Inception-ResNet-v2 achieved a normalized score of 0.924, ranking No. 2 among 107 defense teams, versus 0.773 for adversarial training alone (No. 56).
• The defense supports many attack scenarios, including vanilla, single-pattern, and ensemble-pattern attacks.