# On the Limitations of Denoising Strategies as Adversarial Defenses

arXiv: https://arxiv.org/abs/2012.09384 · HTML: https://mlsanity.com/paper/2012.09384/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Dec 2020.

## Built on by (most cited first, 9 of 9)

- [Reverse Engineering of Imperceptible Adversarial Image Perturbations](https://mlsanity.com/paper/2203.14145/) (2022)
- [Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustness](https://mlsanity.com/paper/2309.16096/) (2023)
- [RAILS: A Robust Adversarial Immune-inspired Learning System](https://mlsanity.com/paper/2107.02840/) (2021)
- [Reverse Engineering ℓp attacks: A block-sparse optimization approach with recovery guarantees](https://mlsanity.com/paper/2203.04886/) (2022)
- [Hindering Adversarial Attacks with Implicit Neural Representations](https://mlsanity.com/paper/2210.13982/) (2022)
- [A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense](https://mlsanity.com/paper/2402.07183/) (2024)
- [Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddings](https://mlsanity.com/paper/2309.01620/) (2023)
- [Dual Head Adversarial Training](https://mlsanity.com/paper/2104.10377/) (2021)
- [Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Model](https://mlsanity.com/paper/2311.16577/) (2023)

## Abstract (arXiv)

As adversarial attacks against machine learning models have raised increasing concerns, many denoising-based defense approaches have been proposed. In this paper, we summarize and analyze the defense strategies in the form of symmetric transformation via data denoising and reconstruction (denoted as F+ inverse F, F-IF Framework). In particular, we categorize these denoising strategies from three aspects (i.e. denoising in the spatial domain, frequency domain, and latent space, respectively). Typically, defense is performed on the entire adversarial example, both image and perturbation are modified, making it difficult to tell how it defends against the perturbations. To evaluate the robustness of these denoising strategies intuitively, we directly apply them to defend against adversarial noise itself (assuming we have obtained all of it), which saving us from sacrificing benign accuracy. Surprisingly, our experimental results show that even if most of the perturbations in each dimension is eliminated, it is still difficult to obtain satisfactory robustness. Based on the above findings and analyses, we propose the adaptive compression strategy for different frequency bands in the feature domain to improve the robustness. Our experiment results show that the adaptive compression strategies enable the model to better suppress adversarial perturbations, and improve robustness compared with existing denoising strategies.