Papers › First line of defense: A robust first layer mitigates adversarial attacks

First line of defense: A robust first layer mitigates adversarial attacks

21 Aug 2024arXiv:2408.11680archive 2025-07-28

Janani Suresh, Nancy Nayak, Sheetal Kalyani

Adversarial training (AT) incurs significant computational overhead, leading to growing interest in designing inherently robust architectures. We demonstrate that a carefully designed first layer of the neural network can serve as an implicit adversarial noise filter (ANF). This filter is created using a combination of large kernel size, increased convolution filters, and a maxpool operation. We show that integrating this filter as the first layer in architectures such as ResNet, VGG, and EfficientNet results in adversarially robust networks. Our approach achieves higher adversarial accuracies than existing natively robust architectures without AT and is competitive with adversarial-trained architectures across a wide range of datasets. Supporting our findings, we show that (a) the decision regions for our method have better margins, (b) the visualized loss surfaces are smoother, (c) the modified peak signal-to-noise ratio (mPSNR) values at the output of the ANF are higher, (d) high-frequency components are more attenuated, and (e) architectures incorporating ANF exhibit better denoising in Gaussian noise compared to baseline architectures. Code for all our experiments are available at \url{https://github.com/janani-suresh-97/first-line-defence.git}.

Paper PDF Code

Code

janani-suresh-97/first-line-defence officialmentioned in paperpytorch report

Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.

Code Syntology ran Syntology

Not run by Syntology. Nothing on this page verifies that the listed code works.

Tasks

Denoising

Results from the paper archive 2025-07-28

No leaderboard rows for this paper in the archive.

Methods

1x1 Convolution Average Pooling Batch Normalization Convolution Dense Connections Depthwise Convolution Depthwise Separable Convolution Dropout EfficientNet Global Average Pooling Inverted Residual Block Kaiming Initialization Max Pooling Pointwise Convolution RMSProp ReLU Sigmoid Activation Softmax Squeeze-and-Excitation Block

Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections