# BUZz: BUffer Zones for defending adversarial examples in image classification

arXiv: https://arxiv.org/abs/1910.02785 · HTML: https://mlsanity.com/paper/1910.02785/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Oct 2019.

## Built on by (most cited first, 2 of 2)

- [On the Robustness of Vision Transformers to Adversarial Examples](https://mlsanity.com/paper/2104.02610/) (2021)
- [Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks](https://mlsanity.com/paper/2109.15031/) (2021)

## Abstract (arXiv)

We propose a novel defense against all existing gradient based adversarial attacks on deep neural networks for image classification problems. Our defense is based on a combination of deep neural networks and simple image transformations. While straightforward in implementation, this defense yields a unique security property which we term buffer zones. We argue that our defense based on buffer zones offers significant improvements over state-of-the-art defenses. We are able to achieve this improvement even when the adversary has access to the em entire original training data set and unlimited query access to the defense. We verify our claim through experimentation using Fashion-MNIST and CIFAR-10: We demonstrate <11% attack success rate -- significantly lower than what other well-known state-of-the-art defenses offer -- at only a price of a 11-18% drop in clean accuracy. By using a new intuitive metric, we explain why this trade-off offers a significant improvement over prior work.