{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/ensemble-adversarial-training-attacks-and","title":"Ensemble Adversarial Training: Attacks and Defenses","arxiv_id":"1705.07204","date":"2017-05-19","proceeding":"ICLR 2018 1","authors":["Florian Tramèr","Alexey Kurakin","Nicolas Papernot","Ian Goodfellow","Dan Boneh","Patrick McDaniel"],"abstract":"Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against strong ones. As a result, we find that adversarial training remains vulnerable to black-box attacks, where we transfer perturbations computed on undefended models, as well as to a powerful novel single-step attack that escapes the non-smooth vicinity of the input data via a small random step. We further introduce Ensemble Adversarial Training, a technique that augments training data with perturbations transferred from other models. On ImageNet, Ensemble Adversarial Training yields models with strong robustness to black-box attacks. In particular, our most robust model won the first round of the NIPS 2017 competition on Defenses against Adversarial Attacks. However, subsequent work found that more elaborate black-box attacks could significantly enhance transferability and reduce the accuracy of our models.","url_abs":"https://arxiv.org/abs/1705.07204v5","url_pdf":"https://arxiv.org/pdf/1705.07204v5.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/CS839/robustness_vs_fairness","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/JZ-LIANG/Ensemble-Adversarial-Training","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/abahram77/mnistChallenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/abahram77/mnist_challenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/andrewilyas/ens-adv-train-attack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/csdongxian/skip-connections-matter","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/luizgh/adversarial_signatures","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"unanswered"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/rwightman/pytorch-nips2017-adversarial","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/sangxia/nips-2017-adversarial","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/tensorflow/models","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/tensorflow/models/tree/master/research/adv_imagenet_models","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/the-full/ops","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/MindCode-4/code-11/tree/main/fed-ensemble-main-ms","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"mindspore","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/MindCode-4/code-7/tree/main/fed-ensemble-main-ms","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"mindspore","reach":null},{"paper_slug":"ensemble-adversarial-training-attacks-and","repo_url":"https://github.com/MindSpore-scientific-2/code-12/tree/main/fed-ensemble-main-ms","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"mindspore","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1705.07204","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1705.07204"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/tensorflow/models","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/andrewilyas/ens-adv-train-attack","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/JZ-LIANG/Ensemble-Adversarial-Training","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MindCode-4/code-7/tree/main/fed-ensemble-main-ms","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/CS839/robustness_vs_fairness","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/tensorflow/models/tree/master/research/adv_imagenet_models","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rwightman/pytorch-nips2017-adversarial","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/luizgh/adversarial_signatures","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MindCode-4/code-11/tree/main/fed-ensemble-main-ms","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/csdongxian/skip-connections-matter","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/sangxia/nips-2017-adversarial","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/the-full/ops","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/abahram77/mnist_challenge","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/abahram77/mnistChallenge","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MindSpore-scientific-2/code-12/tree/main/fed-ensemble-main-ms","reach":null}],"summary":{"ran_honours":2,"unverified":5},"by_repo_kind":{"listed":{"samples":5,"ran":2,"repositories":3}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"dc3545f86c25dbe2","entry":"pseudorandom_target","repo":"andrewilyas/ens-adv-train-attack","repo_kind":"listed","path":"pi-nes.py","file_url":"https://github.com/andrewilyas/ens-adv-train-attack/blob/HEAD/pi-nes.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dc3545f86c25dbe2"}},{"code_sha256_prefix":"108e0e470de94dfe","entry":"pseudorandom_target_image","repo":"andrewilyas/ens-adv-train-attack","repo_kind":"listed","path":"pi-nes.py","file_url":"https://github.com/andrewilyas/ens-adv-train-attack/blob/HEAD/pi-nes.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"108e0e470de94dfe"}},{"code_sha256_prefix":"f0c9a29156911331","entry":"accuracy","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"f0c9a29156911331"}},{"code_sha256_prefix":"913d82af53065418","entry":"accuracy","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"unverified","verification_level":0,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"913d82af53065418"}},{"code_sha256_prefix":"197a1c1869bf9116","entry":"get_image","repo":"andrewilyas/ens-adv-train-attack","repo_kind":"listed","path":"pi-nes.py","file_url":"https://github.com/andrewilyas/ens-adv-train-attack/blob/HEAD/pi-nes.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"197a1c1869bf9116"}},{"code_sha256_prefix":"153a81cace8b8376","entry":"validate","repo":"JZ-LIANG/Ensemble-Adversarial-Training","repo_kind":"listed","path":"ens_adv_train.py","file_url":"https://github.com/JZ-LIANG/Ensemble-Adversarial-Training/blob/HEAD/ens_adv_train.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"153a81cace8b8376"}},{"code_sha256_prefix":"9a06804007efa20b","entry":"validate","repo":"rwightman/pytorch-nips2017-adversarial","repo_kind":"listed","path":"python/train_adversarial_defense.py","file_url":"https://github.com/rwightman/pytorch-nips2017-adversarial/blob/HEAD/python/train_adversarial_defense.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"9a06804007efa20b"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}