Pith. sign in

REVIEW 3 major objections 6 minor 35 references

BlurNet: Defense by Filtering the Feature Maps

T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that total variation regularization on first-layer feature maps reduces the worst-case RP2 adversarial sticker attack success from 90% to 20%, and that low-pass filtering feature maps beats filtering the input.

desk verdict BlurNet makes a sensible bet—smoothing first-layer feature maps against physical stickers—but the '20% worst-case' headline is only as strong as one under-specified adaptive attack, and the paper itself provides reasons to doubt it. read the letter →

arxiv 1908.02256 v2 pith:JA6IPVV4 submitted 2019-08-06 cs.LG stat.ML

Ravi Raju , Mikko Lipasti This is my paper · ORCID
classification cs.LGstat.ML
keywords adversarialrobustnessphysicalperturbationstotalvariationregularizationfeaturemapfilteringlow-passfiltertrafficsignclassificationadaptiveattacksRP2attack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BlurNet asks whether a traffic-sign classifier can be made robust to physically realizable adversarial stickers of the kind produced by the RP2 attack, which places black-and-white stickers on stop signs. The paper's central claim is that the attack's effect appears as high-frequency spikes in the first layer's feature maps, and that low-pass filtering those maps—rather than blurring the input—removes most of the harm. It proposes several ways to bake this filtering into training, and reports that total variation regularization on first-layer feature maps is the one that survives an adaptive adversary: worst-case attack success drops from 90% to 20% with only a modest accuracy loss. If right, this gives a lightweight, architecture-preserving defense for a restricted but realistic threat model, while showing why defenses must be evaluated against attacks tailored to the defense.

What carries the argument

The central mechanism is total variation (TV) regularization applied to the feature maps immediately after the first convolutional layer, with objective $\min \alpha TV \frac{1}{N K} \sum_{i,k} TV(F[i,:,:,k]) + J(f_\theta(x), y)$ (Eq. 4). This penalizes neighboring activation differences, so the localized spike from a sticker is damped at the source. A depthwise convolution layer of 3x3, 5x5, or 7x7 blur kernels plays the same role architecturally, and the paper's FFT analysis of the feature maps motivates why filtering works there but not on the input. Adaptive attacks add the same regularizer to the attack loss (Eq. 9) to probe whether the defense holds.

What would settle it

Run the RP2 adaptive attack against the TV-regularized model with many random restarts, a sweep of the regularizer weight in the attacker's loss, and longer optimization, recording the worst-case success rate over all target classes. If it exceeds 20% or approaches the 90% baseline, the central robustness claim is refuted; if it stays at or below 20%, the defense's evaluated upper bound is supported.

Watch

Extended reading notes

Core claim

The paper establishes that RP2 perturbations introduce high-frequency artifacts in the first convolutional layer's feature maps even though the input spectrum looks unchanged. Convolving those feature maps with blur kernels reduces the attack's success, and training with a total variation penalty on the feature maps lets the first layer learn to suppress the spike while preserving clean accuracy. The strongest claimed result is that under an adaptive attack that adds the same total variation regularizer to the attacker's loss, the worst-case RP2 success rate stays at 20%, whereas the Tikhonov-regularized model that looked best in white-box tests degrades by 30%. The conclusion is that TV-regularized BlurNet is the 'truly robust' model under the RP2 threat model, not because it removes the perturbation from the image, but because it stops the perturbation from propagating through the network.

Load-bearing premise

The 20% worst-case claim assumes that the adaptive attack, a single optimization run with the training regularizer added to the attacker's loss, is strong enough to bound the true adversary; the paper does not verify convergence with multiple restarts or tuned regularization weight, so the real worst case could be worse.

Editorial extensions

If this is right

  • If the TV defense holds, physical sticker attacks on stop signs can be neutralized without altering the input pipeline, the network architecture, or requiring adversarial training.
  • The success of low-pass filtering at the first layer over input filtering implies that the attack's high-frequency signature is most visible in the network's early feature space, not in the input image.
  • Tikhonov regularization's apparent white-box strength but adaptive-attack weakness shows that defenses must be evaluated with adaptive attacks before robustness claims are made.
  • The 100% failure under PGD shows the defense is specific to localized perturbations, reinforcing that robustness must be defined relative to a threat model.
  • Legitimate accuracy stays near 85.6% while the clean baseline is 91%, so the defense costs roughly five points of accuracy for a 70-point drop in worst-case attack success.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to test TV-on-feature-maps against other localized physical perturbations, such as adversarial patches on faces or license plates, since the mechanism only assumes the perturbation is spatially concentrated and creates a high-frequency spike in early activations.
  • The 20% floor could be stress-tested by combining the adaptive attack with projected gradient descent in the sticker region and multiple restarts; until then, 20% is the worst case found by the evaluated attack, not a proven ceiling.
  • Because the defense depends on spatial locality, it could be paired with patch-based detection or adversarial training in a threat-model-specific way, but the paper does not test these combinations.
  • The frequency-analysis motivation suggests the method may transfer to other convolutional architectures with a first layer that preserves spatial locality, though the paper evaluates only one small network.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes BlurNet, a defense against the RP2 physical adversarial patch attack on traffic sign classifiers. The defense is motivated by a frequency analysis showing that the attack introduces high-frequency artifacts in first-layer feature maps. The paper experiments with inserting a depthwise convolution layer of blur kernels after the first layer and with regularizers (total variation, Tikhonov) that encourage low-pass behavior in the feature maps. White-box RP2 evaluations show reduced attack success rates, and an adaptive attack with the training regularizer added to the attacker's loss is used to claim that total variation regularization caps the worst-case attack success rate at 20%, making it the 'truly robust' defense. The paper also reports that all defenses fail under a standard PGD pixel-based adversary, and compares against adversarial training and randomized smoothing baselines.

Significance. If the central claim were established, the paper would make a useful contribution: a simple, architecture-agnostic regularizer that substantially reduces success of a physically realizable, localized-patch attack, while retaining reasonable clean accuracy. The authors do several things right: they evaluate under a specific threat model, they include an adaptive-attack attempt, they acknowledge that PGD breaks the defenses, and they compare with relevant baselines. The main risk is that the evidence for the headline '20% cap' rests on a single adaptive attack whose strength is not established. Because the defense is a smoothing operation, an adversary that deploys low-frequency perturbations (the attack the authors themselves design in Section V-A but do not apply to the TV model) is a natural and untested threat. The empirical base is also thin: 40 test images, one architecture, no error bars, and no code. The contribution is plausible but the paper currently overstates what is proven.

major comments (3)
  1. [Section V-B, Eq. (9), Table III] The claim that TV regularization caps the RP2 attack success rate at 20% is not supported as an upper bound because the adaptive attack is not validated. The attack adds the training TV term to the attacker's loss (Eq. 9) but does not specify a weighting coefficient, is run without restarts or convergence checks, and the DCT low-frequency attack of Section V-A is not applied to the TV-regularized model. Since low-frequency perturbations are the natural way to bypass a smoothing defense, the absence of this attack leaves the 20% figure as a lower bound on the true attack success rate, not an upper bound. The 'truly robust' conclusion is therefore conditional on the adequacy of one attack variant.
  2. [Section V-B, Table III] The L2 dissimilarity distances reported for the TV adaptive attacks (0.044 and 0.046) are roughly an order of magnitude smaller than the white-box values for the same models (0.224 and 0.199 in Table II). This gap suggests that the adaptive attack objective may be dominated by the TV regularizer rather than by the classification loss, so the optimizer may be reducing the perturbation's feature-map variation instead of maximizing misclassification. The paper should report the relative scaling between l_adv and the TV term, and it should demonstrate that the same attack achieves high success on an unregularized model as a sanity check.
  3. [Section IV-D, Table II; Section V-B] The empirical comparison is based on 40 test images, a single architecture, and no error bars or significance tests. Worst-case rates of 17.5% and 10% correspond to 7 and 4 images, respectively, so the ranking of TV versus Tikhonov regularization in the white-box evaluation is not statistically stable. The later adaptive-attack conclusion that TV is 'truly robust' while Tikhf is not also rests on small absolute counts (8 versus 19 images for the 20% vs 47.5% worst-case rates). The paper should report confidence intervals or per-seed variation, and ideally evaluate on a larger set of stop-sign images.
minor comments (6)
  1. [Section IV-B, Eq. (4)] The summation in Eq. (4) uses the index i twice ('N∑i=1 K∑i=1'); the inner sum should use a different index, for example k, to avoid ambiguity.
  2. [Section II-D] The architecture is described only as a 'standard 4 layer DNN classifier'; the number, kernel sizes, strides, padding, and pooling details are needed for reproducibility.
  3. [Table II] The Gaussian augmentation with σ=0.2 yields an average success rate of 55.97% and a worst-case of 80%, which is dramatically worse than both σ=0.1 and σ=0.3. If this is not a typo, the non-monotonic behavior should be explained.
  4. [Section V-A, Figure 3] Figure 3 appears to show the effect of DCT mask dimension only for the 7x7 depthwise-convolution model; the caption and axis labels should be explicit about which defense is being swept.
  5. [References] Reference [27] is called 'Yash et al.' in the text, but the citation is 'Sharma et al.'; the citation formatting should be corrected.
  6. [Section V-A] The paper says the default DCT mask dimension is 16 but only reports a sweep for the 7x7 model; reporting the same sweep for the TV and Tikhonov models would directly address the concern that low-frequency perturbations bypass these defenses.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the defense is evaluated against the external RP2 attack with standard adaptive-attack methodology; remaining concerns are attack-strength limitations, not logical circularity.

full rationale

I examined the paper's derivation chain: the defense is motivated by an FFT analysis of first-layer feature maps, implemented as a depthwise blur layer or as regularizers (L-infinity, total variation, Tikhonov), and evaluated with black-box transfer, white-box RP2, and adaptive attacks that modify the attacker's loss to include the defense's regularizer. The central numerical claims (Tables II and III) are empirical measurements against an external attack algorithm (RP2) on an external dataset (LISA), not derivations from an input. The adaptive attack in Eq. (9) adds the TV regularizer to the attacker's loss; this is the standard recommended way to evaluate a defense without suffering from obfuscated gradients, and including the defense's regularizer does not make the result equivalent to the training objective by construction. The reported success rate still measures actual misclassification after optimization. The omitted regularization-parameter sweep, the lack of restarts, and the fact that the DCT low-frequency attack was not applied to the TV model are limitations on the strength of the claimed upper bound, but they are attack-strength and evaluation-validity concerns rather than circular reductions. No load-bearing self-citation chain appears, no fitted parameter is renamed as a prediction, and no uniqueness theorem is imported. Therefore, the paper's derivation is self-contained with respect to circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The defense rests on the empirical premise that the attack signal is high-frequency in feature space and can be smoothed away, plus the evaluation premise that the adaptive attack bounds the adversary. No new physical entities are introduced.

free parameters (4)
  • Total variation regularization coefficient (alpha_TV) = 1e-4 and 1e-5
    Two values tested in the white-box evaluation (Section IV-D, Table II); no search or validation protocol is reported, and the robustness figure of 20% corresponds to alpha=1e-4.
  • Tikhonov regularization coefficients (alpha_hf, alpha_pseudo) = 1e-4 and 1e-6
    The Tikhf and Tikpseudo variants in Equations (6) and (7) use these coefficients; the paper does not describe how they were chosen.
  • Depthwise convolution filter kernel size = 3x3, 5x5, and 7x7
    Filter width is swept (Section IV-D, Table II) and changes the attack success rate from 55% to 30% worst case; selection criteria are not given.
  • L-infinity regularizer coefficient for depthwise layer = 1e-5 and 0.1 (by kernel size)
    Equation (2) includes an alpha scalar; values differ between the 3x3 and 5x5/7x7 rows, indicating tuning.
assumptions (4)
  • domain assumption RP2 perturbations predominantly introduce high-frequency components in the first-layer feature maps.
    Section III motivates the defense using qualitative FFT pictures (Figure 2); the authors acknowledge low-frequency components are also induced, so the premise is partially violated.
  • domain assumption The evaluation sample of 40 stop-sign images is representative and sufficient.
    Section II-D uses the 40 images from the RP2 repository with no power analysis; each image is 2.5% of the reported success rates.
  • domain assumption The regularization-aware adaptive attack is a valid upper bound on the adversary.
    Section V adds the training regularizer to the attacker's loss (Eq. 9), but no multiple restarts, regularizer weight search, or convergence checks are reported.
  • domain assumption The Cleverhans 4-layer DNN is a standard representative traffic-sign classifier.
    Section II-D; the paper does not test other architectures, and the RP2 attack success may be architecture-dependent.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BlurNet: Defense by Filtering the Feature Maps." pith.science (2026). https://pith.science/paper/JA6IPVV4

@misc{pith2026190802256,
  author       = {Pith},
  title        = {Pith review of: BlurNet: Defense by Filtering the Feature Maps},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JA6IPVV4}},
  note         = {Machine review of arXiv:1908.02256}
}
abstract

Recently, the field of adversarial machine learning has been garnering attention by showing that state-of-the-art deep neural networks are vulnerable to adversarial examples, stemming from small perturbations being added to the input image. Adversarial examples are generated by a malicious adversary by obtaining access to the model parameters, such as gradient information, to alter the input or by attacking a substitute model and transferring those malicious examples over to attack the victim model. Specifically, one of these attack algorithms, Robust Physical Perturbations ($RP_2$), generates adversarial images of stop signs with black and white stickers to achieve high targeted misclassification rates against standard-architecture traffic sign classifiers. In this paper, we propose BlurNet, a defense against the $RP_2$ attack. First, we motivate the defense with a frequency analysis of the first layer feature maps of the network on the LISA dataset, which shows that high frequency noise is introduced into the input image by the $RP_2$ algorithm. To remove the high frequency noise, we introduce a depthwise convolution layer of standard blur kernels after the first layer. We perform a blackbox transfer attack to show that low-pass filtering the feature maps is more beneficial than filtering the input. We then present various regularization schemes to incorporate this low-pass filtering behavior into the training regime of the network and perform white-box attacks. We conclude with an adaptive attack evaluation to show that the success rate of the attack drops from 90\% to 20\% with total variation regularization, one of the proposed defenses.

Figures

Figures reproduced from arXiv: 1908.02256 by the authors.

Figure 1
Figure 1. The frequency spectrum of an unperturbed and perturbed stop sign [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The FFT Spectrum of a subsampling of feature maps from the first [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The impact of the DCT mask dimension on the adaptive attack success [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Plot of the L2 Dissimilarity Distance against the Attack Success Rate [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Plot of the L2 Dissimilarity Distance against the Attack Success Rate [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 11 canonical work pages

  1. [2]

    Anish Athalye, Nicholas Carlini, and David A. Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. CoRR, abs/1802.00420, 2018

    arXiv 2018

  2. [3]

    Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

    Xiaoyu Cao and Neil Zhenqiang Gong. Mitigating evasion attacks to deep neural networks via region-based classification. CoRR, abs/1709.05583, 2017

    work page Pith review arXiv 2017

  3. [4]

    Goodfellow, Aleksander Madry, and Alexey Kurakin

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian J. Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. CoRR, abs/1902.06705, 2019

    arXiv 1902

  4. [5]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. CoRR, abs/1608.04644, 2016

    arXiv 2016

  5. [6]

    Nicholas Carlini and David A. Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. CoRR, abs/1705.07263, 2017

    arXiv 2017

  6. [7]

    Xception: Deep learning with depthwise separable convolutions

    Franc ¸ois Chollet. Xception: Deep learning with depthwise separable convolutions. CoRR, abs/1610.02357, 2016

    arXiv 2016

  7. [8]

    Cohen, Elan Rosenfeld, and J

    Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing. CoRR, abs/1902.02918, 2019

    arXiv 1902

  8. [9]

    Dhillon, Kamyar Azizzadenesheli, Zachary C

    Guneet S. Dhillon, Kamyar Azizzadenesheli, Zachary C. Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial defense. CoRR, abs/1803.01442, 2018

    arXiv 2018

Show all 35 references
  1. [10]

    Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M. Roy. A study of the effect of JPG compression on adversarial images. CoRR, abs/1608.00853, 2016

    2016 arXiv

  2. [11]

    Robust physical-world attacks on machine learning models

    Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust physical-world attacks on machine learning models. CoRR, abs/1707.08945, 2017

    2017 arXiv

  3. [12]

    Explaining and harnessing adversarial examples

    Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015

    2015

  4. [13]

    Alex Graves, Abdel-rahman Mohamed, and Geoffrey E. Hinton. Speech recognition with deep recurrent neural networks. CoRR, abs/1303.5778, 2013

    2013 arXiv

  5. [14]

    Countering adversarial images using input transformations

    Chuan Guo, Mayank Rana, Moustapha Ciss ´e, and Laurens van der Maaten. Countering adversarial images using input transformations. CoRR, abs/1711.00117, 2017

    2017 arXiv

  6. [15]

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. In Proceedings of the 25th International Conference on Neural Information Processing Systems - Volume 1 , NIPS’12, pages 1097–1105, USA, 2012. Curran Associates Inc

    2012

  7. [16]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, abs/1607.02533, 2016

    2016 arXiv

  8. [17]

    Adversarial examples detection in deep networks with convolutional filter statistics

    Xin Li and Fuxin Li. Adversarial examples detection in deep networks with convolutional filter statistics. CoRR, abs/1612.07767, 2016

    2016 arXiv

  9. [18]

    Detecting adversarial examples in deep networks with adaptive noise reduction

    Bin Liang, Hongcheng Li, Miaoqiang Su, Xirong Li, Wenchang Shi, and Xiaofeng Wang. Detecting adversarial examples in deep networks with adaptive noise reduction. CoRR, abs/1705.08378, 2017

    2017 arXiv

  10. [19]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. CoRR, abs/1706.06083, 2017

    2017 arXiv

  11. [20]

    Technical report on the cleverhans v2.1.0 adversarial examples library

    Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jona...

    arXiv

  12. [21]

    McDaniel, and Ian J

    Nicolas Papernot, Patrick D. McDaniel, and Ian J. Goodfellow. Transfer- ability in machine learning: from phenomena to black-box attacks using adversarial samples. CoRR, abs/1605.07277, 2016

    2016 arXiv

  13. [22]

    McDaniel, Ian J

    Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box attacks against deep learning systems using adversarial examples. CoRR, abs/1602.02697, 2016

    2016 arXiv

  14. [23]

    McDaniel, Arunesh Sinha, and Michael P

    Nicolas Papernot, Patrick D. McDaniel, Arunesh Sinha, and Michael P. Wellman. Towards the science of security and privacy in machine learning. CoRR, abs/1611.03814, 2016

    2016 arXiv

  15. [24]

    Simple square smoothing regularization operators

    Lothar Reichel and Qiang Ye. Simple square smoothing regularization operators. Electronic Transactions on Numerical Analysis. Volume, 33:63– 83, 01 2009

    2009

  16. [25]

    Rudin, Stanley Osher, and Emad Fatemi

    Leonid I. Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. In Proceedings of the Eleventh Annual International Conference of the Center for Nonlinear Studies on Experimental Mathematics : Computational Issues in Nonlinear Science...

    1992

  17. [26]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages 1528–1540. ACM, 2016

    2016

  18. [27]

    Brubaker

    Yash Sharma, Gavin Weiguang Ding, and Marcus A. Brubaker. On the effectiveness of low frequency perturbations. CoRR, abs/1903.00073, 2019

    1903 arXiv

  19. [28]

    Intriguing prop- erties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing prop- erties of neural networks. In International Conference on Learning Representations, 2014

    2014

  20. [29]

    On adaptive attacks to adversarial example defenses, 2020

    Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses, 2020

    2020

  21. [30]

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. Mitigating adversarial effects through randomization. CoRR, abs/1711.01991, 2017

    2017 arXiv

  22. [31]

    Yuille, and Kaiming He

    Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. CoRR, abs/1812.03411, 2018

    2018 arXiv

  23. [32]

    Feature squeezing: Detect- ing adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detect- ing adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017

    2017 arXiv

  24. [33]

    Efficient defenses against adversarial attacks

    Valentina Zantedeschi, Maria-Irina Nicolae, and Ambrish Rawat. Efficient defenses against adversarial attacks. CoRR, abs/1707.06728, 2017. VII. S UPPLEMENTARY MATERIAL A. Inserting filters in higher layers We choose only to look at the feature maps after the output of the first l...

    2017 arXiv

  25. [34]

    The motivation of this methodology is that the network will learn the adversarial perturbations introduced by the attacker

    Adversarial training: Adversarial training is the tech- nique of injecting adversarial examples and the corresponding gold standard labels into the training set [12], [19], [28]. The motivation of this methodology is that the network will learn the adversarial perturbations in...

  26. [35]

    In their paper, Guo et al

    Input transformations: Most previous work has applied some type of transform to the input image. In their paper, Guo et al. use total variance minimization and image quilting to transform the input image. They use random pixel dropout and reconstruct the image with the removed...

  27. [36]

    These can be due to operations that are added to the network that are not differentiable so regular gradient based attacks are insufficient

    Other Defenses: Gradient masking refers to the phe- nomenon of the gradients being hidden from the adversary by reducing model sensitivity to small changes applied to the input [22]. These can be due to operations that are added to the network that are not differentiable so re...

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.