# Adversarial Defense by Stratified Convolutional Sparse Coding

arXiv: https://arxiv.org/abs/1812.00037 · HTML: https://mlsanity.com/paper/1812.00037/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Nov 2018.

## Built on by (most cited first, 30 of 31)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [The Dimpled Manifold Model of Adversarial Examples in Machine Learning](https://mlsanity.com/paper/2106.10151/) (2021)
- [One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models](https://mlsanity.com/paper/2406.05491/) (2024)
- [Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models](https://mlsanity.com/paper/2404.10335/) (2024)
- [DISCO: Adversarial Defense with Local Implicit Functions](https://mlsanity.com/paper/2212.05630/) (2022)
- [Can audio-visual integration strengthen robustness under multimodal attacks?](https://mlsanity.com/paper/2104.02000/) (2021)
- [Attack to Fool and Explain Deep Networks](https://mlsanity.com/paper/2106.10606/) (2021)
- [AGKD-BML: Defense Against Adversarial Attack by Attention Guided Knowledge Distillation and Bi-directional Metric Learning](https://mlsanity.com/paper/2108.06017/) (2021)
- [RAILS: A Robust Adversarial Immune-inspired Learning System](https://mlsanity.com/paper/2107.02840/) (2021)
- [Defense against Adversarial Cloud Attack on Remote Sensing Salient Object Detection](https://mlsanity.com/paper/2306.17431/) (2023)
- [Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures](https://mlsanity.com/paper/2403.14772/) (2024)
- [InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle](https://mlsanity.com/paper/2206.12292/) (2022)
- [Perturbation Inactivation Based Adversarial Defense for Face Recognition](https://mlsanity.com/paper/2207.06035/) (2022)
- [CertPri: Certifiable Prioritization for Deep Neural Networks via Movement Cost in Feature Space](https://mlsanity.com/paper/2307.09375/) (2023)
- [Brain Image Synthesis with Unsupervised Multivariate Canonical CSCℓ4Net](https://mlsanity.com/paper/2103.11587/) (2021)
- [Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness](https://mlsanity.com/paper/2106.02867/) (2021)
- [Data-free Defense of Black Box Models Against Adversarial Attacks](https://mlsanity.com/paper/2211.01579/) (2022)
- [A Random-patch based Defense Strategy Against Physical Attacks for Face Recognition Systems](https://mlsanity.com/paper/2304.07822/) (2023)
- [VQUNet: Vector Quantization U-Net for Defending Adversarial Atacks by Regularizing Unwanted Noise](https://mlsanity.com/paper/2406.03117/) (2024)
- [Artificial Immune System of Secure Face Recognition Against Adversarial Attacks](https://mlsanity.com/paper/2406.18144/) (2024)
- [An Investigation of Visual Foundation Models Robustness](https://mlsanity.com/paper/2508.16225/) (2025)
- [Adaptive Clustering of Robust Semantic Representations for Adversarial Image Purification](https://mlsanity.com/paper/2104.02155/) (2021)
- [IRAD: Implicit Representation-driven Image Resampling against Adversarial Attacks](https://mlsanity.com/paper/2310.11890/) (2023)
- [ZeroPur: Succinct Training-Free Adversarial Purification](https://mlsanity.com/paper/2406.03143/) (2024)
- [OTAD: An Optimal Transport-Induced Robust Model for Agnostic Adversarial Attack](https://mlsanity.com/paper/2408.00329/) (2024)
- [Structure-Preserving Progressive Low-rank Image Completion for Defending Adversarial Attacks](https://mlsanity.com/paper/2103.02781/) (2021)
- [Fight Perturbations with Perturbations: Defending Adversarial Attacks via Neuron Influence](https://mlsanity.com/paper/2112.13060/) (2021)
- [On Transfer-based Universal Attacks in Pure Black-box Setting](https://mlsanity.com/paper/2504.08866/) (2025)
- [VERITAS: Verification and Explanation of Realness in Images for Transparency in AI Systems](https://mlsanity.com/paper/2507.05146/) (2025)

## Abstract (arXiv)

We propose an adversarial defense method that achieves state-of-the-art performance among attack-agnostic adversarial defense methods while also maintaining robustness to input resolution, scale of adversarial perturbation, and scale of dataset size. Based on convolutional sparse coding, we construct a stratified low-dimensional quasi-natural image space that faithfully approximates the natural image space while also removing adversarial perturbations. We introduce a novel Sparse Transformation Layer (STL) in between the input image and the first layer of the neural network to efficiently project images into our quasi-natural image space. Our experiments show state-of-the-art performance of our method compared to other attack-agnostic adversarial defense methods in various adversarial settings.