{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,17]],"date-time":"2026-10-17T00:45:39Z","timestamp":1792197939396,"version":"4.4.0"},"reference-count":53,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2023,8,8]],"date-time":"2023-08-08T00:00:00Z","timestamp":1691452800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Neurorobot."],"abstract":"<jats:p>Deep neural networks (DNNs) have been shown to be susceptible to critical vulnerabilities when attacked by adversarial samples. This has prompted the development of attack and defense strategies similar to those used in cyberspace security. The dependence of such strategies on attack and defense mechanisms makes the associated algorithms on both sides appear as closely processes, with the defense method being particularly passive in these processes. Inspired by the dynamic defense approach proposed in cyberspace to address endless arm races, this article defines ensemble quantity, network structure, and smoothing parameters as variable ensemble attributes and proposes a stochastic ensemble strategy based on heterogeneous and redundant sub-models. The proposed method introduces the diversity and randomness characteristic of deep neural networks to alter the fixed correspondence gradient between input and output. The unpredictability and diversity of the gradients make it more difficult for attackers to directly implement white-box attacks, helping to address the extreme transferability and vulnerability of ensemble models under white-box attacks. Experimental comparison of <jats:italic>ASR-vs.-distortion curves<\/jats:italic> with different attack scenarios under CIFAR10 preliminarily demonstrates the effectiveness of the proposed method that even the highest-capacity attacker cannot easily outperform the attack success rate associated with the ensemble smoothed model, especially for untargeted attacks.<\/jats:p>","DOI":"10.3389\/fnbot.2023.1205370","type":"journal-article","created":{"date-parts":[[2023,8,8]],"date-time":"2023-08-08T07:26:08Z","timestamp":1691479568000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Adversarial robustness in deep neural networks based on variable attributes of the stochastic ensemble model"],"prefix":"10.3389","volume":"17","author":[{"given":"Ruoxi","family":"Qin","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Linyuan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xuehui","family":"Du","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pengfei","family":"Xie","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xingyuan","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bin","family":"Yan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2023,8,8]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"14410","DOI":"10.1109\/ACCESS.2018.2807385","article-title":"Threat of adversarial attacks on deep learning in computer vision: a survey","volume":"6","author":"Akhtar","year":"2018","journal-title":"IEEE Access"},{"key":"B2","first-page":"284","article-title":"\u201cSynthesizing robust adversarial examples,\u201d","volume-title":"Proceedings of the 35th International Conference on Machine Learning, ICML 2018","author":"Athalye","year":"2018"},{"key":"B3","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/ICC.2018.8422719","article-title":"\u201cA game theoretic approach to model cyber attack and defense strategies,\u201d","volume-title":"2018 IEEE International Conference on Communications (ICC)","author":"Attiah","year":"2018"},{"key":"B4","first-page":"2814","article-title":"\u201cUnderstanding dropout,\u201d","author":"Baldi","year":"2013","journal-title":"Advances in Neural Information Processing Systems 26: 27th Annual Conference on Neural Information Processing Systems 2013"},{"key":"B5","unstructured":"End to end learning for self-driving cars\n            BojarskiM.\n            TestaD. D.\n            DworakowskiD.\n            FirnerB.\n            FleppB.\n            GoyalP.\n          arXiv [Preprint].2014"},{"key":"B6","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1109\/SP.2017.49","article-title":"\u201cTowards evaluating the robustness of neural networks,\u201d","volume-title":"2017 IEEE Symposium on Security and Privacy","author":"Carlini","year":"2017"},{"key":"B7","first-page":"11190","article-title":"\u201cUnlabeled data improves adversarial robustness,\u201d","author":"Carmon","year":"2019","journal-title":"Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019"},{"key":"B8","first-page":"1310","article-title":"\u201cCertified Adversarial Robustness via Randomized Smoothing,\u201d","volume-title":"Proceedings of the 36th International Conference on Machine Learning","author":"Cohen","year":"2019"},{"key":"B9","unstructured":"Evaluating the adversarial robustness of adaptive test-time defenses\n            CroceF.\n            GowalS.\n            BrunnerT.\n            ShelhammerE.\n            HeinM.\n            CemgilT.\n          arXiv [Preprint].2022"},{"key":"B10","article-title":"\u201cBenchmarking Adversarial Robustness,\u201d","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","author":"Dong","year":"2019"},{"key":"B11","first-page":"9185","article-title":"\u201cBoosting Adversarial Attacks With Momentum,\u201d","volume-title":"2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018","author":"Dong","year":"2018"},{"key":"B12","unstructured":"Deep neural networks as 0-1 mixed integer linear programs: A feasibility study\n            FischettiM.\n            JoJ.\n          arXiv [Preprint].2017"},{"key":"B13","first-page":"4700","article-title":"\u201cDensely Connected Convolutional Networks,\u201d","volume-title":"Proceedings of the IEEE conference on computer vision and pattern recognition. IEEE Conference on Computer Vision and Pattern Recognition","author":"Gao","year":"2017"},{"key":"B14","article-title":"\u201cExplaining and harnessing adversarial examples,\u201d","volume-title":"3rd International Conference on Learning Representations","author":"Goodfellow","year":"2015"},{"key":"B15","first-page":"770","article-title":"\u201cDeep residual learning for image recognition,\u201d","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"He","year":"2016"},{"key":"B16","article-title":"\u201cAdversarial example defense: Ensembles of weak defenses are not strong,\u201d","author":"He","year":"2017","journal-title":"11th USENIX Workshop on Offensive Technologies (WOOT 17"},{"key":"B17","volume-title":"Towards Security Threats of Deep Learning Systems: A Survey. IEEE Transactions on Software Engineering","author":"He","year":"2020"},{"key":"B18","first-page":"2712","article-title":"\u201cUsing pre-training can improve model robustness and uncertainty,\u201d","volume-title":"Proceedings of the 36th International Conference on Machine Learning","author":"Hendrycks","year":"2019"},{"key":"B19","doi-asserted-by":"crossref","first-page":"698","DOI":"10.1007\/978-3-030-59713-9_67","article-title":"\u201cBrain MR to PET synthesis via bidirectional generative adversarial network,\u201d","volume-title":"Medical Image Computing and Computer Assisted Intervention\u2013MICCAI 2020: 23rd International Conference","author":"Hu","year":"2020"},{"key":"B20","unstructured":"Rank verification for exponential families\n            HungK.\n            FithianW.\n          29217963arXiv [Preprint].2016"},{"key":"B21","first-page":"2142","article-title":"\u201cBlack-box Adversarial Attacks with Limited Queries and Information,\u201d","volume-title":"Proceedings of the 35th International Conference on Machine Learning, ICML 2018","author":"Ilyas","year":"2018"},{"key":"B22","author":"Jajodia","year":""},{"key":"B23","year":"2009"},{"key":"B24","doi-asserted-by":"publisher","first-page":"84","DOI":"10.1145\/3065386","article-title":"Imagenet classification with deep convolutional neural networks","volume":"60","author":"Krizhevsky","year":"2017","journal-title":"Commun. ACM"},{"key":"B25","doi-asserted-by":"crossref","first-page":"195","DOI":"10.1007\/978-3-319-94042-7_11","article-title":"\u201cAdversarial attacks and defences competition,\u201d","volume-title":"The NIPS'17 Competition: Building Intelligent Systems","author":"Kurakin","year":"2018"},{"key":"B26","volume-title":"Adversarial Examples in the Physical World","author":"Kurakin","year":"2016"},{"key":"B27","first-page":"6402","article-title":"\u201cSimple and scalable predictive uncertainty estimation using deep ensembles,\u201d","volume-title":"Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017","author":"Lakshminarayanan","year":"2017"},{"key":"B28","doi-asserted-by":"crossref","first-page":"656","DOI":"10.1109\/SP.2019.00044","article-title":"\u201cCertified robustness to adversarial examples with differential privacy,\u201d","volume-title":"2019 IEEE Symposium on Security and Privacy","author":"Lecuyer","year":"2019"},{"key":"B29","first-page":"9459","article-title":"\u201cCertified adversarial robustness with additive noise,\u201d","volume-title":"Annual Conference on Neural Information Processing Systems 2019","author":"Li","year":"2019"},{"key":"B30","first-page":"3866","article-title":"\u201cNATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks,\u201d","volume-title":"Proceedings of the 36th International Conference on Machine Learning","author":"Li","year":"2019"},{"key":"B31","unstructured":"LiuC.\n            FengY.\n            WangR.\n            DongB.\n          Enhancing Certified Robustness of Smoothed Classifiers via Weighted Model Ensembling, CoRR abs\/2005.093632020"},{"key":"B32","first-page":"369","article-title":"\u201cTowards robust neural networks via random self-ensemble,\u201d","author":"Liu","year":"2018","journal-title":"Proceedings of the European Conference on Computer Vision (ECCV)"},{"key":"B33","article-title":"\u201cTowards deep learning models resistant to adversarial attacks,\u201d","volume-title":"6th International Conference on Learning Representations","author":"Madry","year":"2018"},{"key":"B34","first-page":"4970","article-title":"\u201cImproving adversarial robustness via promoting ensemble diversity,\u201d","volume-title":"Proceedings of the 36th International Conference on Machine Learning","author":"Pang","year":"2019"},{"key":"B35","doi-asserted-by":"crossref","first-page":"582","DOI":"10.1109\/SP.2016.41","article-title":"\u201cDistillation as a defense to adversarial perturbations against deep neural networks,\u201d","volume-title":"2016 IEEE Symposium on Security and Privacy (SP)","author":"Papernot","year":"2016"},{"key":"B36","first-page":"41","author":"Parkhi","year":"2015"},{"key":"B37","unstructured":"The effectiveness of data augmentation in image classification using deep learning\n            PerezL.\n            WangJ.\n          arXiv [Preprint].2017"},{"key":"B38","doi-asserted-by":"publisher","first-page":"1137","DOI":"10.1109\/TPAMI.2016.2577031","article-title":"Faster r-cnn: Towards real-time object detection with region proposal networks.n","volume":"39","author":"Ren","year":"2016","journal-title":"IEEE Trans. Pattern Anal. Machine Int."},{"key":"B39","first-page":"4510","article-title":"\u201cMobilenetv2: Inverted residuals and linear bottlenecks,\u201d","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Sandler","year":"2018"},{"key":"B40","unstructured":"\u201cVery deep convolutional networks for large-scale image recognition,\u201d\n            SimonyanK.\n            ZissermanA.\n          3rd International Conference on Learning Representations, ICLR 20152014"},{"key":"B41","first-page":"2818","article-title":"\u201cRethinking the inception architecture for computer vision,\u201d","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Szegedy","year":"2016"},{"key":"B42","article-title":"\u201cIntriguing properties of neural networks,\u201d","author":"Szegedy","year":"2014","journal-title":"2nd International Conference on Learning Representations"},{"key":"B43","first-page":"1","article-title":"\u201cGoing deeper with convolutions,\u201d","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Szegedy","year":"2015"},{"key":"B44","article-title":"\u201cEnsemble adversarial training: attacks and defenses,\u201d","volume-title":"6th International Conference on Learning Representations","author":"Tram\u00e8r","year":"2018"},{"key":"B45","first-page":"5032","article-title":"\u201cAdversarial risk and the dangers of evaluating against weak attacks,\u201d","volume-title":"Proceedings of the 35th International Conference on Machine Learning","author":"Uesato","year":"2018"},{"key":"B46","first-page":"6514","article-title":"Hyperparameter ensembles for robustness and uncertainty quantification","volume":"33","author":"Wenzel","year":"2020","journal-title":"Adv. Neural Inf. Proc. Syst."},{"key":"B47","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-030-29844-9","volume-title":"Cyberspace Mimic Defense - Generalized Robust Control and Endogenous Security","author":"Wu","year":"2020"},{"key":"B48","doi-asserted-by":"publisher","first-page":"2427","DOI":"10.1109\/TIFS.2019.2901798","article-title":"Reducing security risks of suspicious data and codes through a novel dynamic defense model","volume":"14","author":"Wu","year":"2019","journal-title":"IEEE Trans. Inf. Forensics Secur"},{"key":"B49","first-page":"1492","article-title":"\u201cAggregated residual transformations for deep neural networks,\u201d","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Xie","year":"2017"},{"key":"B50","volume-title":"Fine Perceptive GANs for Brain MR Image Super-Resolution in Wavelet Domain. IEEE Transactions on Neural Networks and Learning Systems","author":"You","year":"2022"},{"key":"B51","author":"Zagoruyko","year":"","journal-title":"Wide Residual Networks."},{"key":"B52","unstructured":"\u201cWide residual networks,\u201d\n            ZagoruykoS.\n            KomodakisN.\n          \n            WilsonR. C.\n            HancockE. R.\n            SmithW. A. P.\n          New York, NYBMVA PressProceedings of the British Machine Vision Conference 2016"},{"key":"B53","doi-asserted-by":"publisher","first-page":"6283","DOI":"10.1109\/TII.2021.3139902","article-title":"generating adversarial examples with shadow model","volume":"18","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Ind. Inf."}],"container-title":["Frontiers in Neurorobotics"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fnbot.2023.1205370\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,8,8]],"date-time":"2023-08-08T07:26:51Z","timestamp":1691479611000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fnbot.2023.1205370\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,8]]},"references-count":53,"alternative-id":["10.3389\/fnbot.2023.1205370"],"URL":"https:\/\/doi.org\/10.3389\/fnbot.2023.1205370","relation":{},"ISSN":["1662-5218"],"issn-type":[{"value":"1662-5218","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,8]]},"article-number":"1205370"}}