# Adversarial Defense based on Structure-to-Signal Autoencoders

arXiv: https://arxiv.org/abs/1803.07994 · HTML: https://mlsanity.com/paper/1803.07994/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Mar 2018.

## Built on by (most cited first, 10 of 10)

- [Certified Zeroth-order Black-Box Defense with Robust UNet Denoiser](https://mlsanity.com/paper/2304.06430/) (2023)
- [An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks](https://mlsanity.com/paper/2203.10930/) (2022)
- [Fall Leaf Adversarial Attack on Traffic Sign Classification](https://mlsanity.com/paper/2411.18776/) (2024)
- [SAFE: Secure and Accurate Federated Learning for Privacy-Preserving Brain-Computer Interfaces](https://mlsanity.com/paper/2601.05789/) (2026)
- [Identifying Layers Susceptible to Adversarial Attacks](https://mlsanity.com/paper/2107.04827/) (2021)
- [Enhancing Tracking Robustness with Auxiliary Adversarial Defense Networks](https://mlsanity.com/paper/2402.17976/) (2024)
- [Time Traveling to Defend Against Adversarial Example Attacks in Image Classification](https://mlsanity.com/paper/2410.08338/) (2024)
- [Towards A Conceptually Simple Defensive Approach for Few-shot classifiers Against Adversarial Support Samples](https://mlsanity.com/paper/2110.12357/) (2021)
- [PrivacyProber: Assessment and Detection of Soft-Biometric Privacy-Enhancing Techniques](https://mlsanity.com/paper/2211.08864/) (2022)
- [TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models](https://mlsanity.com/paper/2511.15807/) (2025)

## Abstract (arXiv)

Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers actually use. Based on this, we apply specially trained autoencoders, referred to as S2SNets, as defense mechanism. They follow a two-stage training scheme: first unsupervised, followed by a fine-tuning of the decoder, using gradients from an existing classifier. S2SNets induce a shift in the distribution of gradients propagated through them, stripping them from class-dependent signal. We analyze their robustness against several white-box and gray-box scenarios on the large ImageNet dataset. Our approach reaches comparable resilience in white-box attack scenarios as other state-of-the-art defenses in gray-box scenarios. We further analyze the relationships of AlexNet, VGG 16, ResNet 50 and Inception v3 in adversarial space, and found that VGG 16 is the easiest to fool, while perturbations from ResNet 50 are the most transferable.