On the Limitations of Denoising Strategies as Adversarial Defenses

Understand

As adversarial attacks against machine learning models have raised increasing concerns, many denoising-based defense approaches have been proposed.

• In this paper, we summarize and analyze the defense strategies in the form of symmetric transformation via data denoising and reconstruction (denoted as $F+$ inverse $F$, $F-IF$ Framework).
• In particular, we categorize these denoising strategies from three aspects (i.e.
• denoising in the spatial domain, frequency domain, and latent space, respectively).