Feature Denoising for Improving Adversarial Robustness

Understand

Adversarial attacks to image classification systems present challenges to convolutional networks and opportunities for understanding them.

• This study suggests that adversarial perturbations on images lead to noise in the features constructed by these networks.
• Motivated by this observation, we develop new network architectures that increase adversarial robustness by performing feature denoising.
• Specifically, our networks contain blocks that denoise the features using non-local means or other filters; the entire networks are trained end-to-end.