Research map / Adversarial robustness and security / Certified and empirical robustness
Eliminating Adversarial Noise via Information Discard and Robust Representation Restoration
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add complementary masks + robust representation restoration denoiser (DIR) on top of standard-AT target | denoising defense for adversarially trained target · CIFAR-10 white-box | PGD robust accuracy: 45.72 -> 54.27 | Helped |
| apply prior denoisers (APE-GAN, HGD, NRP) in front of adversarially trained target | denoising defense · CIFAR-10 white-box | PGD robust accuracy: APE-GAN 28.65, HGD 18.07, NRP 21.90 vs None 45.72 | Hurt |
| add DIR denoiser to adversarially trained target | denoising defense · CIFAR-10 white-box AutoAttack | AutoAttack robust accuracy: 42.26 -> 51.34 | Helped |
| add DIR denoiser to adversarially trained target | denoising defense · SVHN white-box | PGD robust accuracy: 50.83 -> 55.30 | Helped |
| transfer DIR denoiser to TRADES and MART targets | denoising defense · CIFAR-10 white-box transfer | PGD robust accuracy: TRADES 49.59 -> 55.43; MART 50.65 -> 56.04 | Helped |
| add DIR denoiser on naturally trained target | denoising defense · CIFAR-10 naturally trained target | robust accuracy: HGD 20.57, JATP 27.06 -> DIR 39.12 | Helped |
| DIR costs more training time than HGD/JATP | DIR · CIFAR-10 training time | time per epoch (ms): HGD 291k, JATP 349k, Ours 527k | Hurt |
| mask spatial ratio 30%/50%/70% (50% chosen) (ablation) | DIR masks · CIFAR-10 mask ratio | PGD robust accuracy: 49.63 (30%), 54.27 (50%), 50.16 (70%) | Mixed |
| remove denoiser pre-training stage (use MSE to natural samples in loss) (ablation) | DIR · CIFAR-10 white-box | PGD robust accuracy: 54.27 -> 47.21 | Hurt |
| add robust representation restoration loss (alpha>0) vs adversarial training alone (alpha=0) (ablation) | DIR denoiser · CIFAR-10 white-box PGD | robust accuracy: qualitative: alpha=0 lower than alpha=2.0 (figure only) | Helped |
| adversarial training applied to baseline denoisers (APE-GAN, HGD, NRP) vs DIR (ablation) | denoising defense · CIFAR-10 white-box | robust accuracy: Figure 6(b) values not given in text; DIR still best | No clear effect |
| adaptive masking-aware attack evaluation of DIR | DIR · CIFAR-10 adaptive attack | robust accuracy: 53.68% under masking-related adaptive attack | Helped |
Closest papers by meaning
- Feature Denoising for Improving Adversarial Robustness (CVPR 2019 · similarity 0.90)
- Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense (NeurIPS 2023 · similarity 0.89)
- First Line of Defense: A Robust First Layer Mitigates Adversarial Attacks (AAAI 2025 · similarity 0.87)
- Improving Adversarial Robustness via Mutual Information Estimation (ICML 2022 · similarity 0.87)
- A Combination of Noise and Bilateral Filters Achieve Supralinear and Scalable Adversarial Robustness in CNNs (CVPR 2026 · similarity 0.87)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.