Research map / Adversarial robustness and security / Black-box and transfer attacks
Countering Adversarial Images using Input Transformations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train and test using the same input transformation | Image transformation defenses · ImageNet, adversarial attacks | top-1 accuracy: 80 !- 90% | Helped |
| Use image quilting against strong attacks | ResNet-50 · ImageNet, black-box attacks | attack defense rate: 80 !- 90% | Helped |
| Use random crop-and-rescale predictions at test time | ResNet-50 · ImageNet, gray-box attacks | top-1 accuracy: 40 !- 60% | Helped |
| Apply TV minimization or image quilting | ResNet-50 · ImageNet, gray-box attacks | top-1 accuracy: 30 !- 40% | Helped |
| Train using the same transformation used at inference | Image transformation defenses · ImageNet, attacks | attack defense rate: 80 !- 90% | Helped |
| Combine quilting, TVM, and cropping instead of quilting alone (ablation) | ImageNet black-box defense ensembles · ImageNet, black-box attacks | top-1 accuracy: 1 !- 2% | Helped |
| Transfer the attack across network architectures (ablation) | ImageNet black-box defense ensembles · ImageNet, black-box attacks | top-1 accuracy: 2 !- 3% | Helped |
| Use bit-depth reduction or JPEG compression against gray-box attacks (ablation) | Transformed ResNet-50 · ImageNet, gray-box attacks | top-1 accuracy | Hurt |
| Use cropping, TV minimization, or quilting against gray-box attacks | Transformed ResNet-50 · ImageNet, gray-box attacks | top-1 accuracy: up to 50% | Helped |
| Combine cropping, TVM, and quilting (ablation) | ResNet-50 · ImageNet, gray-box DeepFool | top-1 accuracy: 51.51% (compared to 1.84%) | Helped |
| Apply image transformations instead of ensemble adversarial training | ResNet-50 / Inception-v4 · ImageNet, FGSM | top-1 accuracy: 49.52 / 31.37 / 39.55; 69.15 | Hurt |
| Apply image transformations instead of ensemble adversarial training | ResNet-50 / Inception-v4 · ImageNet, iterative attacks | top-1 accuracy: 43.89 / 40.99 / 33.22 vs 5.07; 44.92 / 44.69 / 34.54 vs 1.84 | Helped |
Closest papers by meaning
- One Man's Trash Is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples (CVPR 2020 · similarity 0.91)
- Detecting Adversarial Examples Through Image Transformation (AAAI 2018 · similarity 0.90)
- Learning to Attack: Adversarial Transformation Networks (AAAI 2018 · similarity 0.90)
- Enhancing Transformation-Based Defenses Against Adversarial Attacks with a Distribution Classifier (ICLR 2020 · similarity 0.90)
- A Direct Approach to Robust Deep Learning Using Adversarial Networks (ICLR 2019 · similarity 0.89)
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.