{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-defense-by-restricting-the-hidden","title":"Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks","arxiv_id":"1904.00887","date":"2019-04-01","proceeding":"ICCV 2019 10","authors":["Aamir Mustafa","Salman Khan","Munawar Hayat","Roland Goecke","Jianbing Shen","Ling Shao"],"abstract":"Deep neural networks are vulnerable to adversarial attacks, which can fool them by adding minuscule perturbations to the input images. The robustness of existing defenses suffers greatly under white-box attack settings, where an adversary has full knowledge about the network and can iterate several times to find strong perturbations. We observe that the main reason for the existence of such perturbations is the close proximity of different class samples in the learned feature space. This allows model decisions to be totally changed by adding an imperceptible perturbation in the inputs. To counter this, we propose to class-wise disentangle the intermediate feature representations of deep networks. Specifically, we force the features for each class to lie inside a convex polytope that is maximally separated from the polytopes of other classes. In this manner, the network is forced to learn distinct and distant decision regions for each class. We observe that this simple constraint on the features greatly enhances the robustness of learned models, even against the strongest white-box attacks, without degrading the classification performance on clean images. We report extensive evaluations in both black-box and white-box attack scenarios and show significant gains in comparison to state-of-the art defenses.","url_abs":"https://arxiv.org/abs/1904.00887v4","url_pdf":"https://arxiv.org/pdf/1904.00887v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-defense-by-restricting-the-hidden","repo_url":"https://github.com/aamir-mustafa/pcl-adversarial-defense","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/adversarial-defense-on-cifar-10","task":"Adversarial Defense","dataset":"CIFAR-10","model":"PCL (against PGD, white box)","rank_in_archive_order":7,"of":8,"metrics":{"Accuracy":"46.7"},"uses_additional_data":false}],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1904.00887","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1904.00887"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/aamir-mustafa/pcl-adversarial-defense","reach":null}],"summary":{"ran_fixture":3,"ran_honours":1},"by_repo_kind":{"official":{"samples":4,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"a8dfc8ec49230781","entry":"normalize","repo":"aamir-mustafa/pcl-adversarial-defense","repo_kind":"official","path":"robustness.py","file_url":"https://github.com/aamir-mustafa/pcl-adversarial-defense/blob/HEAD/robustness.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a8dfc8ec49230781"}},{"code_sha256_prefix":"c15892ac30a8f0c0","entry":"test","repo":"aamir-mustafa/pcl-adversarial-defense","repo_kind":"official","path":"pcl_training.py","file_url":"https://github.com/aamir-mustafa/pcl-adversarial-defense/blob/HEAD/pcl_training.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c15892ac30a8f0c0"}},{"code_sha256_prefix":"67c367afa6418ca2","entry":"test","repo":"aamir-mustafa/pcl-adversarial-defense","repo_kind":"official","path":"softmax_training.py","file_url":"https://github.com/aamir-mustafa/pcl-adversarial-defense/blob/HEAD/softmax_training.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"67c367afa6418ca2"}},{"code_sha256_prefix":"823c25b30c5a5aaf","entry":"un_normalize","repo":"aamir-mustafa/pcl-adversarial-defense","repo_kind":"official","path":"robustness.py","file_url":"https://github.com/aamir-mustafa/pcl-adversarial-defense/blob/HEAD/robustness.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"823c25b30c5a5aaf"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}