Defending against Adversarial Images using Basis Functions Transformations

In the past five years, the areas of adversarial attacks (Szegedy et al., 2013) on deep learning models, as well as defenses against such attacks, have received significant attention in the deep learning research community (Yuan et al., 2017; Akhtar & Mian, 2018). Defenses against adversarial attacks can be categorized into two main types. Approaches of the first type modify the net training procedures or architectures, usually in order to make the net compute a smooth function; see, for example (Shaham et al., 2015; Gu & Rigazio, 2014; Cisse et al., 2017; Papernot et al., 2016b). Defenses of the second type leave the training procedure and architecture unchanged, but rather modify the data, aiming to detect or remove adversarial perturbations often by smoothing the input data. For example, Guo et al. (2017) applied image transformations, such as total variance minimization and quilting to smooth input images.