{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/mitigating-large-adversarial-perturbations-on","title":"Mitigating large adversarial perturbations on X-MAS (X minus Moving Averaged Samples)","arxiv_id":"1912.12170","date":"2019-12-19","proceeding":null,"authors":["Woohyung Chun","Sung-Min Hong","Junho Huh","Inyup Kang"],"abstract":"We propose the scheme that mitigates the adversarial perturbation $\\epsilon$ on the adversarial example $X_{adv}$ ($=$ $X$ $\\pm$ $\\epsilon$, $X$ is a benign sample) by subtracting the estimated perturbation $\\hat{\\epsilon}$ from $X$ $+$ $\\epsilon$ and adding $\\hat{\\epsilon}$ to $X$ $-$ $\\epsilon$. The estimated perturbation $\\hat{\\epsilon}$ comes from the difference between $X_{adv}$ and its moving-averaged outcome $W_{avg}*X_{adv}$ where $W_{avg}$ is $N \\times N$ moving average kernel that all the coefficients are one. Usually, the adjacent samples of an image are close to each other such that we can let $X$ $\\approx$ $W_{avg}*X$ (naming this relation after X-MAS[X minus Moving Averaged Samples]). By doing that, we can make the estimated perturbation $\\hat{\\epsilon}$ falls within the range of $\\epsilon$. The scheme is also extended to do the multi-level mitigation by configuring the mitigated adversarial example $X_{adv}$ $\\pm$ $\\hat{\\epsilon}$ as a new adversarial example to be mitigated. The multi-level mitigation gets $X_{adv}$ closer to $X$ with a smaller (i.e. mitigated) perturbation than original unmitigated perturbation by setting the moving averaged adversarial sample $W_{avg} * X_{adv}$ (which has the smaller perturbation than $X_{adv}$ if $X$ $\\approx$ $W_{avg}*X$) as the boundary condition that the multi-level mitigation cannot cross over (i.e. decreasing $\\epsilon$ cannot go below and increasing $\\epsilon$ cannot go beyond). With the multi-level mitigation, we can get high prediction accuracies even in the adversarial example having a large perturbation (i.e. $\\epsilon$ $>$ $16$). The proposed scheme is evaluated with adversarial examples crafted by the FGSM (Fast Gradient Sign Method) based attacks on ResNet-50 trained with ImageNet dataset.","url_abs":"https://arxiv.org/abs/1912.12170v4","url_pdf":"https://arxiv.org/pdf/1912.12170v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"mitigating-large-adversarial-perturbations-on","repo_url":"https://github.com/stonylinux/mitigating_large_adversarial_perturbations_on_X-MAS","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":null,"task_name":"Avg"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}