Adaptive patch transformation for adversarial defense

Abstract

Deep learning models are vulnerable to adversarial attacks. Although various defense methods have been proposed, such as incorporating perturbations during training, removing them in preprocessing steps or using image-to-image mapping to counter these attacks, these methods often struggle to robustly defend against diverse adversarial attacks and may affect the model’s predictions on normal samples. To address this issue, we propose an adversarial example defense method based on image transformation. First, we designed an image transformation combiner that integrates multiple image transformations for defending against adversarial examples, thereby enhancing the robustness of the method. Second, we divide the image into patches and apply different combinations of image transformations to each patch to ensure the retention of useful information and increase the flexibility of the transformations. We combined 12 geometric or color transformations using the image transformation combiner and tested it on adversarial examples generated from the MNIST, CIFAR - 10, and ImageNet datasets. Experimental results show that our method outperforms other advanced detection methods in terms of accuracy and effectively mitigates the impact of adversarial perturbations on the model.