Unreasonable Effectiveness of Last Hidden Layer Activations for Adversarial Robustness
Not on the map. Why?
Abstract (arXiv)
In standard Deep Neural Network (DNN) based classifiers, the general convention is to omit the activation function in the last (output) layer and directly apply the softmax function on the logits to get the probability scores of each class. In this type of architectures, the loss value of the classifier against any output class is directly proportional to the difference between the final probability score and the label value of the associated class. Standard White-box adversarial evasion attacks, whether targeted or untargeted, mainly try to exploit the gradient of the model loss function to craft adversarial samples and fool the model. In this study, we show both mathematically and experimentally that using some widely known activation functions in the output layer of the model with high temperature values has the effect of zeroing out the gradients for both targeted and untargeted attack cases, preventing attackers from exploiting the model's loss function to craft adversarial samples. We've experimentally verified the efficacy of our approach on MNIST (Digit), CIFAR10 datasets. Detailed experiments confirmed that our approach substantially improves robustness against gradient-based targeted and untargeted attack threats. And, we showed that the increased non-linearity at the output layer has some additional benefits against some other attack methods like Deepfool attack.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 29 of its 37 references that are in the map. First posted on arXiv 15 Feb 2022.
Builds on
29 of 37 references.
References · 29
- 2015Distilling the Knowledge in a Neural Networkcited by 10,076
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2016Adversarial examples in the physical worldcited by 1,762
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2019On Evaluating Adversarial Robustnesscited by 442
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
17 more
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
- 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
- 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
- 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
- 2019Privacy Risks of Securing Machine Learning Models against Adversarial Examplescited by 136
- 2018Interpretable Adversarial Perturbation in Input Embedding Space for Textcited by 67
- 2018Adversarial Attacks Against Medical Deep Learning Systemscited by 61
- 2017APE-GAN: Adversarial Perturbation Elimination with GANcited by 57
- 2018DARTS: Deceiving Autonomous Cars with Toxic Signscited by 53
- 2019Securing Connected & Autonomous Vehicles: Challenges Posed by Adversarial Machine Learning and The Way Forwardcited by 33
- 2019Fooling a Real Car with Adversarial Traffic Signscited by 29
- 2021Exploiting epistemic uncertainty of the deep learning models to generate adversarial samplescited by 12
- 2020Closeness and Uncertainty Aware Adversarial Examples Detection in Adversarial Machine Learningcited by 6
- 2020A Generative Model based Adversarial Security of Deep Learning and Linear Classifier Modelscited by 2
- 2019Why Blocking Targeted Adversarial Perturbations Impairs the Ability to Learncited by 1
Built on by
Citing papers per year: 2025: 1.
1 paper.