Research map / Adversarial robustness and security / Attacks on text and graphs
Defending Against Universal Attacks Through Selective Feature Regeneration
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply selective feature regeneration to the baseline network | CaffeNet, VGG-F, GoogLeNet, VGG-16, and Res152 · ILSVRC2012, ℓ∞ UAP ξ=10 | restoration accuracy: 0.596 -> 0.976 (CaffeNet); 0.628 -> 0.967 (VGG-F); 0.691 -> 0.970 (GoogLeNet); 0.681 -> 0.963 (VGG-16); 0.670 -> 0.982 ( | Helped |
| Train on ℓ∞ UAP examples and evaluate against an ℓ2 UAP | Selective feature regeneration · ILSVRC2012, ℓ2 UAP ξ=2000 | restoration accuracy: CaffeNet: 0.677 -> 0.964; VGG-F: 0.671 -> 0.961; GoogLeNet: 0.682 -> 0.912; VGG-16: 0.697 -> 0.876; Res152: 0.709 -> 0.9 | Mixed |
| Train at ξ=10 and evaluate against stronger ξ=25 perturbations | CaffeNet defense · ILSVRC2012, ℓ∞ UAP ξ=25 | restoration accuracy: 0.519 -> 0.854 | Helped |
| Train on UAP examples and evaluate on unseen universal attack types | Selective feature regeneration · ILSVRC2012, FFF, NAG, S.Fool, GAP, G-UAP, and sPGD | restoration accuracy: FFF: 0.645 -> 0.941; NAG: 0.670 -> 0.840; S.Fool: 0.815 -> 0.914; GAP: 0.640 -> 0.922; G-UAP: 0.726 -> 0.914; sPGD: 0.67 | Helped |
| Use the defended model against a white-box sPGD attack | Res152 · ILSVRC2012, white-box ℓ∞ sPGD | top-1 accuracy: 0.270 -> 0.731 | Helped |
| Mask adversarial noise in the top 50% most vulnerable activations (ablation) | CaffeNet, GoogLeNet, and VGG-16 · ImageNet training subset, ℓ∞ UAP | top-1 accuracy: CaffeNet: 0.10 -> 0.56; GoogLeNet: 0.25 -> 0.68; VGG-16: 0.25 -> 0.67 | Helped |
| Use only 2 feature regeneration units instead of 6 (ablation) | GoogLeNet · ILSVRC2012, ℓ∞ UAP | restoration accuracy: 97% | Helped |
| Increase feature regeneration units beyond 2 (ablation) | GoogLeNet · ILSVRC2012, ℓ∞ UAP | restoration accuracy | No clear effect |
| Use only 2 feature regeneration units instead of 6 (ablation) | VGG-16 · ILSVRC2012, ℓ∞ UAP | restoration accuracy: 91% | Hurt |
| Increase feature regeneration units from 2 to 6 (ablation) | VGG-16 · ILSVRC2012, ℓ∞ UAP | restoration accuracy: 91% -> 96.2% | Helped |
| Increase feature regeneration units beyond 6 (ablation) | VGG-16 · ILSVRC2012, ℓ∞ UAP | restoration accuracy: 96.2% | Hurt |
Closest papers by meaning
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.88)
- Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.87)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.87)
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.87)
- Generate Universal Adversarial Perturbations for Few-Shot Learning (NeurIPS 2024 · similarity 0.87)
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.