Thwarting Adversarial Examples: An $L_0$-RobustSparse Fourier Transform
Abstract
We give a new algorithm for approximating the Discrete Fourier transform of an approximately sparse signal that has been corrupted by worst-case noise, namely a bounded number of coordinates of the signal have been corrupted arbitrarily. Our techniques generalize to a wide range of linear transformations that are used in data analysis such as the Discrete Cosine and Sine transforms, the Hadamard transform, and their high-dimensional analogs. We use our algorithm to successfully defend against well known adversaries in the setting of image classification. We give experimental results on the Jacobian-based Saliency Map Attack (JSMA) and the Carlini Wagner (CW) attack on the MNIST and Fashion-MNIST datasets as well as the Adversarial Patch on the ImageNet dataset.
Cite
@article{arxiv.1812.05013,
title = {Thwarting Adversarial Examples: An $L_0$-RobustSparse Fourier Transform},
author = {Mitali Bafna and Jack Murtagh and Nikhil Vyas},
journal= {arXiv preprint arXiv:1812.05013},
year = {2018}
}
Comments
Accepted at 32nd Conference on Neural Information Processing Systems (NeurIPS 2018), Montr\'eal, Canada