# A Mask-Based Adversarial Defense Scheme
## 5 Discussion  
In this paper, we have proposed a new mask-based adversarial defense method called MAD, and have conducted extensive experiments showing that our method provides an effective defense against a variety of adversarial attacks. First, the following observations provide a sketch of our strategy for adversarial defense. * Information density is often low in image data, as missing patches from an image can often be mostly recovered by a neural network structure [11] or by a human brain (as you can often reconstruct the missing parts of an object while looking at it through a fence). * Adversarial attacks usually introduce a minor perturbation to inputs, which is likely to be reduced or cancelled by (randomly) covering part of the image. Define \(\tau:\mathbb{R}^{d}\times C\rightarrow\mathbb{R}^{d}\) as a masking operator, where \(C\) is a predefined set which has its cardinality depend on the number of grids that cover the input. For example, masking a \(32\times 32\) image by using \(8\times 8\) grids gives \(2^{16}=65536\) possible ways of masking (2 possibilities for each grid, i.e., to apply masking or not to apply masking. The image is divided into \((32/8)\times(32/8)=16\) grids), so that in this case one may set \(|C|=2^{64}\). An extreme case is that all grids are masked, but this can hardly happen as we pick up grids probabilistically. Suppose the original classifier \(f_{\theta}\) is trained with sample set \(Z\), and we use the sample set \(Z\times C\) to retrain the existing structure into a new DNN model \(f_{\theta^{\prime}}:\mathbb{R}^{d}\rightarrow\mathcal{Y}\) that is used to \"simulate\" the performance of \(f_{\theta}\), in the sense that given \(x\in\mathcal{X}\), so as to enhance the robustness of the model. At the same time, the attacker needs to generate \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack Method** & **MagNet** & \
\begin{tabular}{c} **Denoised** \\ **Smoothing** \\ \end{tabular} &
\begin{tabular}{c} **Parseval** \\ **Networks** \\ \end{tabular} & **PCL** & **MAD** \\ \hline Benign & 82.32\% & 77.92\% & 77.89\% & **83.47\%** & 82.65\% \\ \hline FGSM L1 \(\epsilon=15\) & 67.41\% & 81.97\% & 43.20\% & 74.94\% & **82.63\%** \\ FGSM L1 \(\epsilon=20\) & 65.68\% & 76.50\% & 33.11\% & 70.53\% & **79.25\%** \\ FGSM L2 \(\epsilon=0.3\) & 72.15\% & **85.88**\% & 52.41\% & 79.54\% & 84.62\% \\ FGSM L2 \(\epsilon=0.4\) & 69.75\% & 81.70\% & 42.69\% & 75.32\% & **81.89\%** \\ FGSM Lin \(\epsilon=0.01\) & 57.81\% & **82.83**\% & 44.22\% & 75.56\% & 81.05\% \\ FGSM Lin \(\epsilon=0.02\) & 44.96\% & 65.25\% & 20.75\% & 62.72\% & **68.77\%** \\ BIM L1 \(\epsilon=10\) & 66.56\% & 80.11\% & 45.23\% & 64.03\% & **84.71\%** \\ BIM L1 \(\epsilon=15\) & 62.63\% & 68.58\% & 26.22\% & 48.03\% & **80.91\%** \\ BIM L2 \(\epsilon=0.3\) & 67.63\% & 77.36\% & 38.57\% & 61.26\% & **83.21\%** \\ BIM L2 \(\epsilon=0.4\) & 65.73\% & 68.06\% & 24.96\% & 48.34\% & **80.88\%** \\ BIM Linf \(\epsilon=0.01\) & 51.34\% & 75.51\% & 29.54\% & 59.83\% & **81.80\%** \\ BIM Linf \(\epsilon=0.015\) & 42.84\% & 62.41\% & 13.52\% & 43.31\% & **77.06\%** \\ PGD L1 \(\epsilon=15\) & 67.08\% & 79.83\% & 37.84\% & 66.63\% & **85.44\%** \\ PGD L1 \(\epsilon=20\) & 64.66\% & 72.81\% & 24.64\% & 53.18\% & **83.48\%** \\ PGD L2 \(\epsilon=0.3\) & 71.98\% & 84.65\% & 48.20\% & 76.08\% & **86.42\%** \\ PGD L2 \(\epsilon=0.4\) & 69.44\% & 79.17\% & 35.14\% & 66.70\% & **84.45\%** \\ PGD Linf \(\epsilon=0.01\) & 56.92\% & 81.17\% & 36.89\% & 72.22\% & **84.78\%** \\ PGD Linf \(\epsilon=0.015\) & 47.79\% & 70.74\% & 19.35\% & 54.74\% & **81.45\%** \\ CW L2 \(\epsilon=1\) & 92.58\% & **99.74\%** & 43.42\% & 89.48\% & 91.28\% \\ DeepFool L2 \(\epsilon=0.6\) & 63.84\% & 65.04\% & 34.10\% & 49.95\% & **84.20\%** \\ DeepFool L2 \(\epsilon=0.8\) & 60.45\% & 57.97\% & 44.51\% & 47.68\% & **81.19\%** \\ DeepFool Linf \(\epsilon=0.01\) & 62.79\% & 81.43\% & 30.49\% & 58.80\% & **85.23\%** \\ DeepFool Linf \(\epsilon=0.015\) & 54.26\% & 71.68\% & 9.49\% & 53.28\% & **80.44\%** \\ \hline \hline \end{tabular}
\end{table}