# Combating Adversarial Attacks Using Sparse Representations

arXiv: https://arxiv.org/abs/1803.03880 · HTML: https://mlsanity.com/paper/1803.03880/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Mar 2018.

## Built on by (most cited first, 9 of 9)

- [On Incorporating Inductive Biases into VAEs](https://mlsanity.com/paper/2106.13746/) (2021)
- [Investigating the Vulnerability of LLM-as-a-Judge Architectures to Prompt-Injection Attacks](https://mlsanity.com/paper/2505.13348/) (2025)
- [Fast and Controllable Post-training Sparsity: Learning Optimal Sparsity Allocation with Global Constraint in Minutes](https://mlsanity.com/paper/2405.05808/) (2024)
- [On Trace of PGD-Like Adversarial Attacks](https://mlsanity.com/paper/2205.09586/) (2022)
- [Surprises in adversarially-trained linear regression](https://mlsanity.com/paper/2205.12695/) (2022)
- [RIGID: Robust Linear Regression with Missing Data](https://mlsanity.com/paper/2205.13635/) (2022)
- [Sparsity-Driven Plasticity in Multi-Task Reinforcement Learning](https://mlsanity.com/paper/2508.06871/) (2025)
- [Robust, Deep, and Reinforcement Learning for Management of Communication and Power Networks](https://mlsanity.com/paper/2202.05395/) (2022)
- [Enhance DNN Adversarial Robustness and Efficiency via Injecting Noise to Non-Essential Neurons](https://mlsanity.com/paper/2402.04325/) (2024)

## Abstract (arXiv)

It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks (DNNs). In this paper, we make the case that sparse representations of the input data are a crucial tool for combating such attacks. For linear classifiers, we show that a sparsifying front end is provably effective against ℓ∞-bounded attacks, reducing output distortion due to the attack by a factor of roughly K / N where N is the data dimension and K is the sparsity level. We then extend this concept to DNNs, showing that a "locally linear" model can be used to develop a theoretical foundation for crafting attacks and defenses. Experimental results for the MNIST dataset show the efficacy of the proposed sparsifying front end.