  Some deep neural networks are invariant to some input transformations, such
as Pointnetis permutation invariant to the input point cloud. In this paper, we
demonstrated this property can be powerful in the defense of gradient based
attacks. Specifically, we apply random input transformation which is invariant
to networks we want to defend. Extensive experiments demonstrate that the
proposed scheme outperforms the SOTA defense methods, and breaking the attack
accuracy into nearly zero.
