# Encryption Inspired Adversarial Defense for Visual Classification

arXiv: https://arxiv.org/abs/2005.07998 · HTML: https://mlsanity.com/paper/2005.07998/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 May 2020.

## Built on by (most cited first, 17 of 17)

- [An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applications](https://mlsanity.com/paper/2201.11006/) (2022)
- [A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access](https://mlsanity.com/paper/2105.14756/) (2021)
- [The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attacks](https://mlsanity.com/paper/2305.14188/) (2023)
- [Image and Model Transformation with Secret Key for Vision Transformer](https://mlsanity.com/paper/2207.05366/) (2022)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [Block shuffling learning for Deepfake Detection](https://mlsanity.com/paper/2202.02819/) (2022)
- [On the Transferability of Adversarial Examples between Encrypted Models](https://mlsanity.com/paper/2209.02997/) (2022)
- [Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Models](https://mlsanity.com/paper/2307.13985/) (2023)
- [An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks](https://mlsanity.com/paper/2203.10930/) (2022)
- [Efficient Fine-Tuning with Domain Adaptation for Privacy-Preserving Vision Transformer](https://mlsanity.com/paper/2401.05126/) (2024)
- [A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense](https://mlsanity.com/paper/2402.07183/) (2024)
- [Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddings](https://mlsanity.com/paper/2309.01620/) (2023)
- [Transfer Learning-Based Model Protection With Secret Key](https://mlsanity.com/paper/2103.03525/) (2021)
- [Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Model](https://mlsanity.com/paper/2311.16577/) (2023)
- [Adversarial Detector with Robust Classifier](https://mlsanity.com/paper/2202.02503/) (2022)
- [An Encryption Method of ConvMixer Models without Performance Degradation](https://mlsanity.com/paper/2207.11939/) (2022)
- [A Random Ensemble of Encrypted models for Enhancing Robustness against Adversarial Examples](https://mlsanity.com/paper/2401.02633/) (2024)

## Abstract (arXiv)

Conventional adversarial defenses reduce classification accuracy whether or not a model is under attacks. Moreover, most of image processing based defenses are defeated due to the problem of obfuscated gradients. In this paper, we propose a new adversarial defense which is a defensive transform for both training and test images inspired by perceptual image encryption methods. The proposed method utilizes a block-wise pixel shuffling method with a secret key. The experiments are carried out on both adaptive and non-adaptive maximum-norm bounded white-box attacks while considering obfuscated gradients. The results show that the proposed defense achieves high accuracy (91.55 %) on clean images and (89.66 %) on adversarial examples with noise distance of 8/255 on CIFAR-10 dataset. Thus, the proposed defense outperforms state-of-the-art adversarial defenses including latent adversarial training, adversarial training and thermometer encoding.