# VectorDefense: Vectorization as a Defense to Adversarial Examples

arXiv: https://arxiv.org/abs/1804.08529 · HTML: https://mlsanity.com/paper/1804.08529/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Apr 2018.

## Built on by (most cited first, 6 of 6)

- [The effectiveness of feature attribution methods and its correlation with automatic evaluation scores](https://mlsanity.com/paper/2105.14944/) (2021)
- [A Person Re-identification Data Augmentation Method with Adversarial Defense Effect](https://mlsanity.com/paper/2101.08783/) (2021)
- [Local Competition and Stochasticity for Adversarial Robustness in Deep Learning](https://mlsanity.com/paper/2101.01121/) (2021)
- [Understanding Adversarial Robustness Against On-manifold Adversarial Examples](https://mlsanity.com/paper/2210.00430/) (2022)
- [Robust Upper Bounds for Adversarial Training](https://mlsanity.com/paper/2112.09279/) (2021)
- [Holistic Deep Learning](https://mlsanity.com/paper/2110.15829/) (2021)

## Abstract (arXiv)

Training deep neural networks on images represented as grids of pixels has brought to light an interesting phenomenon known as adversarial examples. Inspired by how humans reconstruct abstract concepts, we attempt to codify the input bitmap image into a set of compact, interpretable elements to avoid being fooled by the adversarial structures. We take the first step in this direction by experimenting with image vectorization as an input transformation step to map the adversarial examples back into the natural manifold of MNIST handwritten digits. We compare our method vs. state-of-the-art input transformations and further discuss the trade-offs between a hand-designed and a learned transformation defense.