[orange3xchicken]

It turns out that a similar technique, where you basically apply noise multiple times to a single image, and average predictions over all noisy images- equivalent to convolving your nn with Gaussian noise yields near state of the art bounds on provable robustness (under a specific class of attacks). The issue is the magnitude of noise you need in order to get practically robust networks is quite large relative to the data you are dealing with.

https://arxiv.org/abs/1902.02918

https://arxiv.org/abs/1906.04584

[TheDudeMan]

These are the papers I've been wondering why didn't exist ;)

Thanks!