Research map / Adversarial robustness and security / Certified and empirical robustness

First Line of Defense: A Robust First Layer Mitigates Adversarial Attacks

AAAI 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Robustness-accuracy trade-off analysis · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes an Adversarial Noise Filter (ANF), a redesigned first convolution layer (large kernel, more filters, maxpool) that gives natively robust ResNet, VGG, and EfficientNet models without adversarial training.

Problem

Adversarial attacks (FGSM, PGD, AutoAttack) severely degrade DNN accuracy, and adversarial training is computationally expensive; existing native-robustness methods modify many layers rather than the input stage.

Approach

Replace only the first convolution layer with an ANF block combining a large kernel (3 to 15), more output filters (16 to 256), and a max-pool (5x5), which implicitly suppresses adversarial noise and attenuates high frequencies; the same ANF design is reused across architectures, and an mPSNR metric quantifies denoising.

Key results

• ResNet20 on CIFAR10: ANF reaches 59.98% PGD and 55.14% AutoAttack accuracy vs 27.03% and 12.41% for the baseline, without adversarial training.
• ResNet50 on ImageNet with ANF plus adversarial training reaches 55.46% PGD and 52.95% AA vs 37% and 24.32% for AT.
• mPSNR at the first residual block for ResNet20 rises from 22.66 (baseline) to 89.92 for the full ANF (K, F, M combined).

Measured effects reported in the paper

Surprising findings

• ANF alone does not confer native robustness on ImageNet; adversarial training is needed there.
• Increasing the number of filters and kernel size reduces clean accuracy (ResNet20 clean accuracy drops from 91.26% to 83.09%).

Limitations

• Clean accuracy drops relative to baselines for several architectures (e.g., ResNet20 CIFAR10 91.26% to 83.09%).
• On ImageNet, ANF alone is not sufficiently robust and requires adversarial training.
• Robustness evaluated on a small set of white-box attacks at epsilon 1/255 by default.

Experimental setup

Datasets: CIFAR10 CIFAR100 TinyImageNet ImageNet

Benchmarks: CIFAR10 CIFAR100 TinyImageNet ImageNet

Metrics: adversarial accuracy under FGSM, PGD, AutoAttack clean accuracy corruption (Gaussian noise) accuracy mPSNR

Baselines: Frequency filter regularization (FLP/GA native robustness) FLP Patch Gaussian augmentation (GA) Adversarial training (FGSM-based AT) Feature denoising AT

Builds on: adversarial training AutoAttack PGD frequency filter regularization

Closest papers by meaning

• A Combination of Noise and Bilateral Filters Achieve Supralinear and Scalable Adversarial Robustness in CNNs (CVPR 2026 · similarity 0.93)
• Neural Architecture Search for Wide Spectrum Adversarial Robustness (AAAI 2023 · similarity 0.90)
• Weight-covariance alignment for adversarially robust neural networks (ICML 2021 · similarity 0.89)
• Robust NAS under adversarial training: benchmark, theory, and beyond (ICLR 2024 · similarity 0.89)
• Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
• Towards Accurate and Robust Architectures via Neural Architecture Search (CVPR 2024 · similarity 0.88)