Adversarial Defenses for Vision
Train on attacks during training, detect them at serving, or squeeze them out in preprocessing, each priced in clean accuracy and compute.
Why Does This Exist?
Every attack page ends with the same demand: beat PGD, not FGSM. Defenses answer three ways. Adversarial training feeds crafted attacks into training so boundaries move away from cheap flips. Detection flags suspicious inputs at serving for review or rejection. Preprocessing squeezes inputs through denoising or compression hoping perturbations die first.
Threat model governs all three: defended attack set with budgets, from gradients to queries, plus the clean-accuracy and latency budget. A defense without those stated defends nothing checkable. Guarantees beyond empirical training live in certified robustness and randomized smoothing.
Think of It Like This
Sparring partners, bouncers, and metal detectors
A boxer spars against aggressive partners to survive real bouts, posts bouncers to refuse suspicious entrants, and walks everyone through a detector that strips hidden items. Sparring is adversarial training, bouncers are detection, detectors are preprocessing. The analogy stops at adaptation: opponents study the sparring style and return stronger, while detectors never face a thinking enemy.
How It Actually Works
Adversarial training replaces clean batches with attacked versions each step, usually PGD at budget 0.03, and minimizes loss on those. Detection trains a second head on attack statistics such as prediction margins or reconstruction error. Preprocessing applies JPEG compression, bit reduction, or denoisers before the classifier. Hybrids stack squeezing before a trained model plus a detector on the margin.
Worked example with recomputed numbers
Demo classifier clean 0.90. Plain training under PGD at 0.03 keeps 0.04, matching the attack page. Adversarial training with PGD inside every batch holds 0.81 under the same attack while clean accuracy settles at 0.86, a 0.04 price, and training time triples from one to three gradient passes per batch. Add a margin detector at 5 percent false-positive rate: it catches 62 of the residual 19 failures, sending them to review, at the cost of reviewing 5 clean images per 100.
Trade and condition
Adversarial training assumes the defended attack set is known and affordable to generate per step; novel attacks outside the set still succeed. Detection assumes a review path exists and false positives are tolerable. Preprocessing alone assumes weak attacks, since adaptive attackers optimize through known squeezes.
Watch Out For
Gradient masking sold as robustness
Defenses that shatter or hide gradients stop FGSM while PGD with restarts or query attacks walk around them, and the badge survives exactly until an adaptive evaluation. The symptom is high white-box numbers with collapsing black-box or transfer numbers. Evaluate with adaptive attacks that know the defense, and report transfer results beside direct ones.
The Quick Version
- Three layers: train on attacks, detect suspects, squeeze inputs.
- Adversarial training holds 0.81 under PGD here, priced 0.04 clean and 3x time.
- Detection catches 62 of residual failures at 5 percent review cost.
- Preprocessing alone stops weak attacks and falls to adaptive ones.
- Every defense names its attack set, budgets, clean price, and adaptive results.