{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/learn2perturb-an-end-to-end-feature","title":"Learn2Perturb: an End-to-end Feature Perturbation Learning to Improve Adversarial Robustness","arxiv_id":"2003.01090","date":"2020-03-02","proceeding":"CVPR 2020 6","authors":["Ahmadreza Jeddi","Mohammad Javad Shafiee","Michelle Karg","Christian Scharfenberger","Alexander Wong"],"abstract":"While deep neural networks have been achieving state-of-the-art performance across a wide variety of applications, their vulnerability to adversarial attacks limits their widespread deployment for safety-critical applications. Alongside other adversarial defense approaches being investigated, there has been a very recent interest in improving adversarial robustness in deep neural networks through the introduction of perturbations during the training process. However, such methods leverage fixed, pre-defined perturbations and require significant hyper-parameter tuning that makes them very difficult to leverage in a general fashion. In this study, we introduce Learn2Perturb, an end-to-end feature perturbation learning approach for improving the adversarial robustness of deep neural networks. More specifically, we introduce novel perturbation-injection modules that are incorporated at each layer to perturb the feature space and increase uncertainty in the network. This feature perturbation is performed at both the training and the inference stages. Furthermore, inspired by the Expectation-Maximization, an alternating back-propagation training algorithm is introduced to train the network and noise parameters consecutively. Experimental results on CIFAR-10 and CIFAR-100 datasets show that the proposed Learn2Perturb method can result in deep neural networks which are $4-7\\%$ more robust on $l_{\\infty}$ FGSM and PDG adversarial attacks and significantly outperforms the state-of-the-art against $l_2$ $C\\&W$ attack and a wide range of well-known black-box attacks.","url_abs":"https://arxiv.org/abs/2003.01090v2","url_pdf":"https://arxiv.org/pdf/2003.01090v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"learn2perturb-an-end-to-end-feature","repo_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2003.01090","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2003.01090"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":6},"by_repo_kind":{"listed":{"samples":6,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"58612379912d59c0","entry":"EOT_FGSM","repo":"Ahmadreza-Jeddi/Learn2Perturb","repo_kind":"listed","path":"attacks/eot.py","file_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb/blob/HEAD/attacks/eot.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"58612379912d59c0"}},{"code_sha256_prefix":"2e013e2ceb5c8210","entry":"EOT_PGD","repo":"Ahmadreza-Jeddi/Learn2Perturb","repo_kind":"listed","path":"attacks/eot.py","file_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb/blob/HEAD/attacks/eot.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2e013e2ceb5c8210"}},{"code_sha256_prefix":"fd1f0b10f905c6a8","entry":"fgsm","repo":"Ahmadreza-Jeddi/Learn2Perturb","repo_kind":"listed","path":"attacks/fgsm.py","file_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb/blob/HEAD/attacks/fgsm.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fd1f0b10f905c6a8"}},{"code_sha256_prefix":"fbe5a39c0d5c5325","entry":"grad_find","repo":"Ahmadreza-Jeddi/Learn2Perturb","repo_kind":"listed","path":"attacks/eot.py","file_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb/blob/HEAD/attacks/eot.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fbe5a39c0d5c5325"}},{"code_sha256_prefix":"7a3b2444fdf90e6e","entry":"l2p_resnet_v2","repo":"Ahmadreza-Jeddi/Learn2Perturb","repo_kind":"listed","path":"models/resnet_v2.py","file_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb/blob/HEAD/models/resnet_v2.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a3b2444fdf90e6e"}},{"code_sha256_prefix":"e0919d109e7e3ae4","entry":"pgd","repo":"Ahmadreza-Jeddi/Learn2Perturb","repo_kind":"listed","path":"attacks/pgd.py","file_url":"https://github.com/Ahmadreza-Jeddi/Learn2Perturb/blob/HEAD/attacks/pgd.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e0919d109e7e3ae4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}