Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddings
Not on the map. Why?
Abstract (arXiv)
In this paper, we propose a new key-based defense focusing on both efficiency and robustness. Although the previous key-based defense seems effective in defending against adversarial examples, carefully designed adaptive attacks can bypass the previous defense, and it is difficult to train the previous defense on large datasets like ImageNet. We build upon the previous defense with two major improvements: (1) efficient training and (2) optional randomization. The proposed defense utilizes one or more secret patch embeddings and classifier heads with a pre-trained isotropic network. When more than one secret embeddings are used, the proposed defense enables randomization on inference. Experiments were carried out on the ImageNet dataset, and the proposed defense was evaluated against an arsenal of state-of-the-art attacks, including adaptive ones. The results show that the proposed defense achieves a high robust accuracy and a comparable clean accuracy compared to the previous key-based defense.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 46 of its 60 references that are in the map. First posted on arXiv 4 Sep 2023.
Builds on
46 of 60 references.
References · 46
- 2017Attention Is All You Needcited by 60,361
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Adversarial examples in the physical worldcited by 1,769
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,446
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
34 more
- 2020Fast is better than free: Revisiting adversarial trainingcited by 727
- 2017Evasion Attacks against Machine Learning at Test Timecited by 689
- 2013Speech Recognition with Deep Recurrent Neural Networkscited by 669
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
- 2019Adversarial Training for Free!cited by 643
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
- 2017Countering Adversarial Images using Input Transformationscited by 520
- 2017Mitigating Adversarial Effects Through Randomizationcited by 383
- 2021Pay Attention to MLPscited by 368
- 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 351
- 2021ResMLP: Feedforward networks for image classification with data-efficient trainingcited by 339
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2018Certified Defenses against Adversarial Examplescited by 306
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
- 2022Patches Are All You Need?cited by 201
- 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 185
- 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
- 2017Generative Adversarial Perturbationscited by 153
- 2021CycleMLP: A MLP-like Architecture for Dense Predictioncited by 126
- 2021Vision Permutator: A Permutable MLP-Like Architecture for Visual Recognitioncited by 103
- 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
- 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
- 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 43
- 2020Block-wise Image Transformation with Secret Key for Adversarially Robust Defensecited by 30
- 2022An Overview of Compressible and Learnable Image Transformation with Secret Key and Its Applicationscited by 29
- 2017Attacking the Madry Defense Model with L1-based Adversarial Examplescited by 21
- 2020Encryption Inspired Adversarial Defense for Visual Classificationcited by 17
- 2021Dodging Attack Using Carefully Crafted Natural Makeupcited by 17
- 2019Adversarially Robust Learning Could Leverage Computational Hardnesscited by 13
- 2020On the Limitations of Denoising Strategies as Adversarial Defensescited by 9
- 2018Bridging machine learning and cryptography in defence against adversarial attackscited by 5
- 2023Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Modelscited by 4
- 2022Hindering Adversarial Attacks with Implicit Neural Representationscited by 3
Built on by
Citing papers per year: 2023: 1; 2024: 1.
2 papers.