mlsanityData to 7 Oct 2026

General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignments

arXiv 2212.05387 ↗First posted 11 Dec 2022cs.CVcited by 4

Not on the map. Why?

Abstract (arXiv)

Deep Neural Networks (DNNs) are vulnerable to the black-box adversarial attack that is highly transferable. This threat comes from the distribution gap between adversarial and clean samples in feature space of the target DNNs. In this paper, we use Deep Generative Networks (DGNs) with a novel training mechanism to eliminate the distribution gap. The trained DGNs align the distribution of adversarial samples with clean ones for the target DNNs by translating pixel values. Different from previous work, we propose a more effective pixel level training constraint to make this achievable, thus enhancing robustness on adversarial samples. Further, a class-aware feature-level constraint is formulated for integrated distribution alignment. Our approach is general and applicable to multiple tasks, including image classification, semantic segmentation, and object detection. We conduct extensive experiments on different datasets. Our strategy demonstrates its unique effectiveness and generality against black-box attacks.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 63 of its 78 references that are in the map. First posted on arXiv 11 Dec 2022.

Builds on

63 of 78 references.

References · 63

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  9. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  12. 2016Pyramid Scene Parsing Networkcited by 2,472
38 more
  1. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,154
  2. 2016Adversarial examples in the physical worldcited by 1,762
  3. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  4. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  5. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2017High-Resolution Image Synthesis and Semantic Manipulation with Conditional GANscited by 1,176
  8. 2016Least Squares Generative Adversarial Networkscited by 1,000
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  10. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  11. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  12. 2019Adversarial Training for Free!cited by 638
  13. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  14. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  15. 2017Countering Adversarial Images using Input Transformationscited by 517
  16. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  17. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  18. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  19. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  20. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  21. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  22. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  23. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  24. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  25. 2018Physical Adversarial Examples for Object Detectorscited by 163
  26. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  27. 2017Receptive Field Block Net for Accurate and Fast Object Detectioncited by 140
  28. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  29. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  30. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  31. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  32. 2019PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Drivingcited by 72
  33. 2018Deflecting Adversarial Attacks with Pixel Deflectioncited by 71
  34. 2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
  35. 2019Image Super-Resolution as a Defense Against Adversarial Attackscited by 64
  36. 2017APE-GAN: Adversarial Perturbation Elimination with GANcited by 57
  37. 2019Adversarial Defense by Restricting the Hidden Space of Deep Neural Networkscited by 56
  38. 2019Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifierscited by 56

50 most cited of 63 All 63 (JSON)

Built on by

Cited by year

Citing papers per year: 2023: 1; 2024: 1; 2025: 2.

4 papers.

  1. 2024Boosting Image Restoration via Priors from Pre-trained Modelscited by 6
  2. 2023Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learningcited by 2
  3. 2025Jailbreaking Commercial Black-Box LLMs with Explicitly Harmful Promptscited by 1
  4. 2025Class Incremental Medical Image Segmentation via Prototype-Guided Calibration and Dual-Aligned Distillationcited by 0