mlsanityData to 14 Oct 2026

Adversarial Defenses via Vector Quantization

arXiv 2305.13651 ↗First posted 23 May 2023cs.LG cs.CR cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks pose significant challenges to the robustness of modern deep neural networks in computer vision, and defending these networks against adversarial attacks has attracted intense research efforts. Among various defense strategies, preprocessing-based defenses are practically appealing since there is no need to train the network under protection. However, such approaches typically do not achieve comparable robustness as other methods such as adversarial training. In this paper, we propose a novel framework for preprocessing-based defenses, where a vector quantizer is used as a preprocessor. This framework, inspired by and extended from Randomized Discretization (RandDisc), is theoretically principled by rate-distortion theory: indeed, RandDisc may be viewed as a scalar quantizer, and rate-distortion theory suggests that such quantization schemes are inferior to vector quantization. In our framework, the preprocessing vector quantizer treats the input image as a collection of patches and finds a set of representative patches based on the patch distributions; each original patch is then modified according to the representative patches close to it. We present two lightweight defenses in this framework, referred to as patched RandDisc (pRD) and sliding-window RandDisc (swRD), where the patches are disjoint in the former and overlapping in the latter. We show that vector-quantization-based defenses have certifiable robust accuracy and that pRD and swRD demonstrate state-of-the-art performances, surpassing RandDisc by a large margin. Notably, the proposed defenses possess the obfuscated gradients property. Our experiments however show that pRD and swRD remain effective under the STE and EOT attacks, which are designed specifically for defenses with gradient obfuscation. ...

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 50 of its 75 references that are in the map. First posted on arXiv 23 May 2023.

Builds on

50 of 75 references.

References · 50

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2016Wide Residual Networkscited by 3,070
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  10. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  11. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  12. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
38 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  2. 2016Adversarial Machine Learning at Scalecited by 936
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  4. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  5. 2016Universal adversarial perturbationscited by 784
  6. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  7. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  8. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  10. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  11. 2017Countering Adversarial Images using Input Transformationscited by 520
  12. 2020Overfitting in adversarially robust deep learningcited by 506
  13. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  14. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  15. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  16. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  17. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  18. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  19. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
  20. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  21. 2018Certified Defenses against Adversarial Examplescited by 306
  22. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  23. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  24. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  25. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  26. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  27. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  28. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  29. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  30. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  31. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 111
  32. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 105
  33. 2015Learning with a Strong Adversarycited by 68
  34. 2016Simple Black-Box Adversarial Perturbations for Deep Networkscited by 42
  35. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  36. 2020Random Smoothing Might be Unable to Certify ℓ_∞ Robustness for High-Dimensional Imagescited by 35
  37. 2019Defending against Whitebox Adversarial Attacks via Randomized Discretizationcited by 29
  38. 2017Regularizing deep networks using efficient layerwise adversarial trainingcited by 24

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNs
  2. 2021Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes
  3. 2022Threat Model-Agnostic Adversarial Defense using Diffusion Models
  4. 2021Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs
  5. 2023Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training
  6. 2024Mitigating Adversarial Perturbations for Deep Reinforcement Learning via Vector Quantization
  7. 2025TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networks
  8. 2023QuantAttack: Exploiting Dynamic Quantization to Attack Vision Transformers