Detecting AutoAttack Perturbations in the Frequency Domain

arXiv:2111.08785v3 Announce Type: replace-cross
Abstract: Recently, adversarial attacks on image classification networks by the AutoAttack (Croce and Hein, 2020b) framework have drawn a lot of attention. While AutoAttack has shown a very high attack success rate, most defense approaches are focusing on network hardening and robustness enhancements, like adversarial training. This way, the currently best-reported method can withstand about 66% of adversarial examples on CIFAR10. In this paper, we investigate the spatial and frequency domain properties of AutoAttack and propose …

adversarial adversarial attacks arxiv attack attacks attention classification cs.cr cs.cv defense domain framework hardening high image lot network networks rate robustness training