Thwarting Adversarial Examples: An L_0-Robust Sparse Fourier Transform

By Mitali Bafna, Jack Murtagh, Nikhil Vyas. 2018

51 citations recorded by the source corpus.

We give a new algorithm for approximating the Discrete Fourier transform of an approximately sparse signal that is robust to worst-case $L_0$ corruptions, namely that some coordinates of the signal can be corrupt arbitrarily. Our techniques generalize to a wide range of linear transformations that are used in data analysis such as the Discrete Cosine and Sine transforms, the Hadamard transform, and their high-dimensional analogs. We use our algorithm to successfully defend against worst-case $L_0$ adversaries in the setting of image classification. We give experimental results on the Jacobian-based Saliency Map Attack (JSMA) and the CW $L_0$ attack on the MNIST and Fashion-MNIST datasets as well as the Adversarial Patch on the ImageNet dataset.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations (2020, methodology): “1 `0 Sparse: (Bafna et al., 2018); ABS and Binary-ABS: (Schott et al.”
Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness (2019, background): “For example, Bafna et al. (2018) develops a `0 perturbation-robust classifier that relies on the sparse Fourier transform.”
On Adaptive Attacks to Adversarial Example Defenses (2020, background): “…et al., 2020) Section 6 The Odds are Odd (Roth et al., 2019) Section 7 Generative Classiﬁers (Li et al., 2019) Section 8 Sparse Fourier Transform (Bafna et al., 2018) Section 9 Rethinking Cross Entropy (Pang et al., 2020a) Section 10 Error Correcting Codes (Verma & Swami, 2019) Section 11…”