Research map / Adversarial robustness and security / Black-box and transfer attacks
Feature Denoising for Improving Adversarial Robustness
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add four non-local Gaussian denoising blocks | Adversarially trained ResNet-152 · ImageNet validation, PGD 10 iterations, ε=16 | top-1 accuracy: 52.5% to 55.7%; 3.2% | Helped |
| Add four non-local Gaussian denoising blocks | Adversarially trained ResNet-152 · ImageNet validation, PGD 2000 iterations, ε=16 | top-1 accuracy: 39.2% to 42.6%; 3.4% | Helped |
| Add four non-local Gaussian denoising blocks | Adversarially trained ResNet-152 · ImageNet validation, CAAD 2017 five attackers, all-or-nothing | top-1 accuracy: 43.1 to 46.4 | Helped |
| Add non-local Gaussian denoising after every residual block (ablation) | Adversarially trained ResNet-152 · ImageNet validation, CAAD 2017 five attackers, all-or-nothing | top-1 accuracy: 43.1% to 49.5%; 6.4% | Helped |
| Use dot-product rather than Gaussian non-local means (ablation) | ResNet-152 with four denoising blocks · ImageNet validation, CAAD 2017 five attackers, all-or-nothing | top-1 accuracy: 46.4% to 46.2% | Hurt |
| Replace non-local denoising with local mean, median, or bilateral filtering (ablation) | ResNet-152 with four denoising blocks · ImageNet validation, CAAD 2017 five attackers, all-or-nothing | top-1 accuracy: 43.6%–44.4% | No clear effect |
| Remove the 1×1 convolution from each denoising block (ablation) | ResNet-152 with four non-local Gaussian blocks · ImageNet validation, PGD 100 iterations, ε=16 | top-1 accuracy: 45.5 to 36.8 | Hurt |
| Remove the residual connection from denoising blocks (ablation) | ResNet-152 with four non-local Gaussian blocks · ImageNet validation, PGD training | training stability | Hurt |
| Use a 1×1-only null block instead of feature denoising (ablation) | ResNet-152 with four denoising blocks · ImageNet validation, CAAD 2017 five attackers, all-or-nothing | top-1 accuracy: 46.4 to 44.1 | Hurt |
| Add denoising blocks to a clean-trained ResNet-152 (ablation) | ResNet-152 · ImageNet validation, clean images | top-1 accuracy: within ±0.2% of baseline | No clear effect |
| Train ResNet-152 + non-local Gaussian blocks adversarially rather than cleanly (ablation) | ResNet-152 with non-local Gaussian denoising · ImageNet validation, clean images | top-1 accuracy: 79.08% to 65.30% | Hurt |
| Add all-block non-local Gaussian denoising with subsampling | ResNeXt-101-32×8 · CAAD 2018 secret ImageNet-like test set, 48 unknown attackers | classification accuracy: 50.6% versus 40.8%; ∼10% absolute | Helped |
Closest papers by meaning
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.92)
- Robust Models are less Over-Confident (NeurIPS 2022 · similarity 0.91)
- Benchmarking Adversarial Robustness on Image Classification (CVPR 2020 · similarity 0.91)
- (Certified!!) Adversarial Robustness for Free! (ICLR 2023 · similarity 0.90)
- Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense (NeurIPS 2023 · similarity 0.90)
- First Line of Defense: A Robust First Layer Mitigates Adversarial Attacks (AAAI 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.