# Defending against Adversarial Images using Basis Functions Transformations

arXiv: https://arxiv.org/abs/1803.10840 · HTML: https://mlsanity.com/paper/1803.10840/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Mar 2018.

## Built on by (most cited first, 11 of 11)

- [Adversarial Robustness with Semi-Infinite Constrained Learning](https://mlsanity.com/paper/2110.15767/) (2021)
- [Taxonomy of Machine Learning Safety: A Survey and Primer](https://mlsanity.com/paper/2106.04823/) (2021)
- [HybridAugment++: Unified Frequency Spectra Perturbations for Model Robustness](https://mlsanity.com/paper/2307.11823/) (2023)
- [How Robust are Discriminatively Trained Zero-Shot Learning Models?](https://mlsanity.com/paper/2201.10972/) (2022)
- [Identifying Adversarially Attackable and Robust Samples](https://mlsanity.com/paper/2301.12896/) (2023)
- [IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metrics](https://mlsanity.com/paper/2403.05955/) (2024)
- [Hindering Adversarial Attacks with Implicit Neural Representations](https://mlsanity.com/paper/2210.13982/) (2022)
- [A Red Teaming Framework for Securing AI in Maritime Autonomous Systems](https://mlsanity.com/paper/2312.11500/) (2023)
- [Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers](https://mlsanity.com/paper/2101.11060/) (2021)
- [FBI: Fingerprinting models with Benign Inputs](https://mlsanity.com/paper/2208.03169/) (2022)
- [Retina gap junctions support the robust perception by warping neural representational geometries along the visual hierarchy](https://mlsanity.com/paper/2604.14200/) (2026)

## Abstract (arXiv)

We study the effectiveness of various approaches that defend against adversarial attacks on deep networks via manipulations based on basis function representations of images. Specifically, we experiment with low-pass filtering, PCA, JPEG compression, low resolution wavelet approximation, and soft-thresholding. We evaluate these defense techniques using three types of popular attacks in black, gray and white-box settings. Our results show JPEG compression tends to outperform the other tested defenses in most of the settings considered, in addition to soft-thresholding, which performs well in specific cases, and yields a more mild decrease in accuracy on benign examples. In addition, we also mathematically derive a novel white-box attack in which the adversarial perturbation is composed only of terms corresponding a to pre-determined subset of the basis functions, of which a "low frequency attack" is a special case.