{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/feature-denoising-for-improving-adversarial","title":"Feature Denoising for Improving Adversarial Robustness","arxiv_id":"1812.03411","date":"2018-12-09","proceeding":"CVPR 2019 6","authors":["Cihang Xie","Yuxin Wu","Laurens van der Maaten","Alan Yuille","Kaiming He"],"abstract":"Adversarial attacks to image classification systems present challenges to\nconvolutional networks and opportunities for understanding them. This study\nsuggests that adversarial perturbations on images lead to noise in the features\nconstructed by these networks. Motivated by this observation, we develop new\nnetwork architectures that increase adversarial robustness by performing\nfeature denoising. Specifically, our networks contain blocks that denoise the\nfeatures using non-local means or other filters; the entire networks are\ntrained end-to-end. When combined with adversarial training, our feature\ndenoising networks substantially improve the state-of-the-art in adversarial\nrobustness in both white-box and black-box attack settings. On ImageNet, under\n10-iteration PGD white-box attacks where prior art has 27.9% accuracy, our\nmethod achieves 55.7%; even under extreme 2000-iteration PGD white-box attacks,\nour method secures 42.6% accuracy. Our method was ranked first in Competition\non Adversarial Attacks and Defenses (CAAD) 2018 --- it achieved 50.6%\nclassification accuracy on a secret, ImageNet-like test dataset against 48\nunknown attackers, surpassing the runner-up approach by ~10%. Code is available\nat https://github.com/facebookresearch/ImageNet-Adversarial-Training.","url_abs":"http://arxiv.org/abs/1812.03411v2","url_pdf":"http://arxiv.org/pdf/1812.03411v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"feature-denoising-for-improving-adversarial","repo_url":"https://github.com/facebookresearch/ImageNet-Adversarial-Training","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"feature-denoising-for-improving-adversarial","repo_url":"https://github.com/lirundong/quant-pack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"},{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/adversarial-defense-on-caad-2018","task":"Adversarial Defense","dataset":"CAAD 2018","model":"Feature Denoising","rank_in_archive_order":1,"of":1,"metrics":{"Accuracy":"50.6%"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-defense-on-imagenet","task":"Adversarial Defense","dataset":"ImageNet","model":"Feature Denoising","rank_in_archive_order":3,"of":3,"metrics":{"Accuracy":"49.5%"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-defense-on-imagenet-targeted-pgd","task":"Adversarial Defense","dataset":"ImageNet (targeted PGD, max perturbation=16)","model":"ResNet-152 Denoise","rank_in_archive_order":1,"of":3,"metrics":{"Accuracy":"42.8"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-defense-on-imagenet-targeted-pgd","task":"Adversarial Defense","dataset":"ImageNet (targeted PGD, max perturbation=16)","model":"ResNeXt-101 DenoiseAll","rank_in_archive_order":2,"of":3,"metrics":{"Accuracy":"40.4"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-defense-on-imagenet-targeted-pgd","task":"Adversarial Defense","dataset":"ImageNet (targeted PGD, max perturbation=16)","model":"ResNet-152","rank_in_archive_order":3,"of":3,"metrics":{"Accuracy":"39.0"},"uses_additional_data":false}],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1812.03411","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}