Research map / Adversarial robustness and security / Certified and empirical robustness
PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| purify inputs with PixelDefend | CIFAR-10 ResNet · CIFAR-10, strongest attack, epsilon_attack=8 | accuracy: 32% to 70% | Helped |
| purify inputs with PixelDefend | Fashion MNIST ResNet · Fashion MNIST, strongest attack | accuracy: 63% to 84% | Helped |
| add PixelDefend to adversarial FGSM training | CIFAR-10 ResNet · CIFAR-10, strongest attack, epsilon_attack=16 | accuracy: 6% to 56% | Helped |
| add PixelDefend to adversarial FGSM training | Fashion MNIST ResNet · Fashion MNIST, strongest attack | accuracy: 76% to 85% | Helped |
| adapt the purification radius using input likelihood (ablation) | PixelDefend · Fashion MNIST, strongest attack | accuracy: 85/76 -> 85/84 | Helped |
| adapt the purification radius using input likelihood (ablation) | PixelDefend · CIFAR-10, strongest attack | accuracy: 81/69/56 -> 81/70/56 | Mixed |
| combine feature squeezing with adversarial training | ResNet · Fashion MNIST and CIFAR-10 attack settings | accuracy | Helped |
| train with BIM rather than FGSM adversarial examples | CIFAR-10 ResNet · CIFAR-10, strongest attack, epsilon_attack=8 | accuracy: 2% to 32% | Helped |
| use label smoothing | ResNet · FGSM versus more advanced attacks | accuracy | Mixed |
| apply greedy PixelCNN decoding instead of L-BFGS-B for purification (ablation) | CIFAR-10 FGSM images · CIFAR-10 FGSM purification | bits per dimension | Helped |
| purify adversarial examples with PixelDefend | DeepFool and CW adversarial images · CIFAR-10 | p-value detection | Hurt |
Closest papers by meaning
- Generative Adversarial Perturbations (CVPR 2018 · similarity 0.90)
- One Man's Trash Is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples (CVPR 2020 · similarity 0.90)
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models (ICLR 2018 · similarity 0.90)
- Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspective (NeurIPS 2024 · similarity 0.89)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.88)
- Pixel Is Not a Barrier: An Effective Evasion Attack for Pixel-Domain Diffusion Models (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.