Mitigating Adversarial Effects Through Randomization
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE Create LICENSE Oct 4, 2017

Mitigating Adversarial Effects Through Randomization

This paper proposed to utilize randomization to mitigate adversarial effects ( By combining the proposed randomization method with an adversarially trained model, it ranked No.2 among 107 defense teams in the NIPS 2017 adversarial examples defense challenge (

The approach

The main ideal of the defense is to utilize randomization to defend adversarial examples:

  • Random Resizing: after pre-processing, resize the original image (size of 299 x 299 x 3) to a larger size, Rnd x Rnd x 3, randomly, where Rnd is within the range [310, 331).
  • Random Padding: after resizing, pad the resized image to a new image with size 331 x 331 x 3, where the padding size at left, right, upper, bottom are [a, 331-Rnd-a, b, 331-Rnd-b]. The possible padding pattern for the size Rnd is (331-Rnd+1)^2.

In general, the pipeline is shown below:



  1. No additional training/finetuning is required
  2. Very little computation introduced
  3. Compatiable to different networks and different defending methods (i.e., we use randomization + ensemble adversarial training + Inception-Resnet-v2 in our submission)

Ensemble adversarial training model

Team Member

  • Cihang Xie (Johns Hopkins University)
  • Zhishuai Zhang (Johns Hopkins University)
  • Jianyu Wang (Baidu Research)
  • Zhou Ren (Snap Inc.)


Our team name is iyswim, and our rank is No.2.

Citing this work

If you find this work is useful in your research, please consider citing:

    title={Mitigating Adversarial Effects Through Randomization},
    author={Xie, Cihang and Wang, Jianyu and Zhang, Zhishuai and Ren, Zhou and Yuille, Alan},
    booktitle={International Conference on Learning Representations},