{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/local-gradients-smoothing-defense-against","title":"Local Gradients Smoothing: Defense against localized adversarial attacks","arxiv_id":"1807.01216","date":"2018-07-03","proceeding":null,"authors":["Muzammal Naseer","Salman H. Khan","Fatih Porikli"],"abstract":"Deep neural networks (DNNs) have shown vulnerability to adversarial attacks,\ni.e., carefully perturbed inputs designed to mislead the network at inference\ntime. Recently introduced localized attacks, Localized and Visible Adversarial\nNoise (LaVAN) and Adversarial patch, pose a new challenge to deep learning\nsecurity by adding adversarial noise only within a specific region without\naffecting the salient objects in an image. Driven by the observation that such\nattacks introduce concentrated high-frequency changes at a particular image\nlocation, we have developed an effective method to estimate noise location in\ngradient domain and transform those high activation regions caused by\nadversarial noise in image domain while having minimal effect on the salient\nobject that is important for correct classification. Our proposed Local\nGradients Smoothing (LGS) scheme achieves this by regularizing gradients in the\nestimated noisy region before feeding the image to DNN for inference. We have\nshown the effectiveness of our method in comparison to other defense methods\nincluding Digital Watermarking, JPEG compression, Total Variance Minimization\n(TVM) and Feature squeezing on ImageNet dataset. In addition, we systematically\nstudy the robustness of the proposed defense mechanism against Back Pass\nDifferentiable Approximation (BPDA), a state of the art attack recently\ndeveloped to break defenses that transform an input sample to minimize the\nadversarial effect. Compared to other defense mechanisms, LGS is by far the\nmost resistant to BPDA in localized adversarial attack setting.","url_abs":"http://arxiv.org/abs/1807.01216v2","url_pdf":"http://arxiv.org/pdf/1807.01216v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"local-gradients-smoothing-defense-against","repo_url":"https://github.com/Muzammal-Naseer/NRP","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"local-gradients-smoothing-defense-against","repo_url":"https://github.com/Ping-C/certifiedpatchdefense","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"local-gradients-smoothing-defense-against","repo_url":"https://github.com/cv-stuttgart/detectiondefenses","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"local-gradients-smoothing-defense-against","repo_url":"https://github.com/metallurk/local_gradients_smoothing","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"local-gradients-smoothing-defense-against","repo_url":"https://github.com/mshane911/NRP","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1807.01216","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}