{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/perceptual-adversarial-robustness-defense","title":"Perceptual Adversarial Robustness: Defense Against Unseen Threat Models","arxiv_id":"2006.12655","date":"2020-06-22","proceeding":null,"authors":["Cassidy Laidlaw","Sahil Singla","Soheil Feizi"],"abstract":"A key challenge in adversarial robustness is the lack of a precise mathematical characterization of human perception, used in the very definition of adversarial attacks that are imperceptible to human eyes. Most current attacks and defenses try to avoid this issue by considering restrictive adversarial threat models such as those bounded by $L_2$ or $L_\\infty$ distance, spatial perturbations, etc. However, models that are robust against any of these restrictive threat models are still fragile against other threat models. To resolve this issue, we propose adversarial training against the set of all imperceptible adversarial examples, approximated using deep neural networks. We call this threat model the neural perceptual threat model (NPTM); it includes adversarial examples with a bounded neural perceptual distance (a neural network-based approximation of the true perceptual distance) to natural images. Through an extensive perceptual study, we show that the neural perceptual distance correlates well with human judgements of perceptibility of adversarial examples, validating our threat model. Under the NPTM, we develop novel perceptual adversarial attacks and defenses. Because the NPTM is very broad, we find that Perceptual Adversarial Training (PAT) against a perceptual attack gives robustness against many other types of adversarial attacks. We test PAT on CIFAR-10 and ImageNet-100 against five diverse adversarial attacks. We find that PAT achieves state-of-the-art robustness against the union of these five attacks, more than doubling the accuracy over the next best model, without training against any of them. That is, PAT generalizes well to unforeseen perturbation types. This is vital in sensitive applications where a particular threat model cannot be assumed, and to the best of our knowledge, PAT is the first adversarial training defense with this property.","url_abs":"https://arxiv.org/abs/2006.12655v4","url_pdf":"https://arxiv.org/pdf/2006.12655v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"perceptual-adversarial-robustness-defense","repo_url":"https://github.com/cassidylaidlaw/perceptual-advex","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"perceptual-adversarial-robustness-defense","repo_url":"https://github.com/centerforaisafety/adversarial-corruptions","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"},{"task_slug":"perceptual-distance","task_name":"Perceptual Distance"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2006.12655","atlas_url":"https://app.syntology.ai/?focus=2006.12655","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2006.12655"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/centerforaisafety/adversarial-corruptions","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/cassidylaidlaw/perceptual-advex","reach":null}],"summary":{"ran":9,"ran_draft_wrong":1,"ran_honours":1,"unverified":3},"by_repo_kind":{"official":{"samples":12,"ran":9,"repositories":1},"listed":{"samples":2,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":2,"samples":[{"code_sha256_prefix":"7145686c67025ec1","entry":"AlexNetFeatureModel","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7145686c67025ec1"}},{"code_sha256_prefix":"739afba6923ed65c","entry":"BisectionPerceptualProjection","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"739afba6923ed65c"}},{"code_sha256_prefix":"e39bb656fc085ddb","entry":"CifarAlexNet","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e39bb656fc085ddb"}},{"code_sha256_prefix":"74e9725f2c4515bd","entry":"ImageNetNormalizer","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"74e9725f2c4515bd"}},{"code_sha256_prefix":"5153783f8169f34c","entry":"MarginLoss","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5153783f8169f34c"}},{"code_sha256_prefix":"5b2c8693ad3f1ba0","entry":"NewtonsPerceptualProjection","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5b2c8693ad3f1ba0"}},{"code_sha256_prefix":"5569d8317369619e","entry":"NoProjection","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5569d8317369619e"}},{"code_sha256_prefix":"5f40d79adb31f436","entry":"Normalize","repo":"centerforaisafety/adversarial-corruptions","repo_kind":"listed","path":"models/cifar10/preactresnet18.py","file_url":"https://github.com/centerforaisafety/adversarial-corruptions/blob/HEAD/models/cifar10/preactresnet18.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5f40d79adb31f436"}},{"code_sha256_prefix":"86c37d42bbcb2386","entry":"PreActResNet","repo":"centerforaisafety/adversarial-corruptions","repo_kind":"listed","path":"models/cifar10/preactresnet18.py","file_url":"https://github.com/centerforaisafety/adversarial-corruptions/blob/HEAD/models/cifar10/preactresnet18.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"86c37d42bbcb2386"}},{"code_sha256_prefix":"cf259b114c239eb5","entry":"get_lpips_model","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf259b114c239eb5"}},{"code_sha256_prefix":"016b0a2f3d92b2bd","entry":"normalize_flatten_features","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"016b0a2f3d92b2bd"}},{"code_sha256_prefix":"cc2c7f04f7f8cc5a","entry":"FastLagrangePerceptualAttack","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cc2c7f04f7f8cc5a"}},{"code_sha256_prefix":"3fd9de784fa31909","entry":"FeatureModel","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3fd9de784fa31909"}},{"code_sha256_prefix":"af3b041cc30c1970","entry":"LPIPSDistance","repo":"cassidylaidlaw/perceptual-advex","repo_kind":"official","path":"perceptual_advex/perceptual_attacks.py","file_url":"https://github.com/cassidylaidlaw/perceptual-advex/blob/HEAD/perceptual_advex/perceptual_attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"af3b041cc30c1970"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}