# A Mask-Based Adversarial Defense Scheme
## 4 Results
### The Main Result and Comparison
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Training** & **4\(\times\)4** & **4\(\times\)4** & **8\(\times\)8** & **8\(\times\)8** & **8\(\times\)8** \\
**Test** & **2\(\times\)2** & **4\(\times\)4** & **2\(\times\)2** & **4\(\times\)4** & **8\(\times\)8** \\ \hline Benign & 73.23\% & 76.92\% & 63.11\% & 82.65\% & 82.89\% \\ \hline FGSM L1 \(\epsilon=15\) & 86.63\% & 83.84\% & 85.34\% & 82.63\% & 75.68\% \\ FGSM L1 \(\epsilon=20\) & 83.20\% & 79.39\% & 82.74\% & 79.25\% & 71.72\% \\ FGSM L2 \(\epsilon=0.3\) & 89.54\% & 87.13\% & 86.17\% & 84.62\% & 79.84\% \\ FGSM L2 \(\epsilon=0.4\) & 86.63\% & 83.41\% & 85.34\% & 81.89\% & 75.11\% \\ FGSM Linf\(\epsilon=0.01\) & 86.10\% & 82.11\% & 84.42\% & 81.05\% & 73.63\% \\ FGSM Linf\(\epsilon=0.02\) & 73.64\% & 67.07\% & 73.93\% & 68.77\% & 59.87\% \\ BIM L1 \(\epsilon=10\) & 89.21\% & 85.66\% & 87.64\% & 84.71\% & 75.67\% \\ BIM L1 \(\epsilon=15\) & 84.62\% & 79.36\% & 85.61\% & 80.91\% & 65.50\% \\ BIM L2 \(\epsilon=0.3\) & 87.52\% & 83.55\% & 86.12\% & 83.21\% & 71.88\% \\ BIM L2 \(\epsilon=0.4\) & 83.64\% & 78.06\% & 85.50\% & 80.88\% & 65.82\% \\ BIM Linf \(\epsilon=0.01\) & 86.60\% & 81.86\% & 86.47\% & 81.80\% & 68.67\% \\ BIM Linf \(\epsilon=0.015\) & 81.26\% & 72.97\% & 83.62\% & 77.06\% & 56.05\% \\ PGD L1 \(\epsilon=15\) & 88.99\% & 84.76\% & 86.64\% & 85.44\% & 76.14\% \\ PGD L1 \(\epsilon=20\) & 85.78\% & 80.08\% & 86.23\% & 83.48\% & 71.13\% \\ PGD L2 \(\epsilon=0.3\) & 90.35\% & 87.03\% & 88.07\% & 86.42\% & 78.77\% \\ PGD L2 \(\epsilon=0.4\) & 88.01\% & 83.48\% & 87.20\% & 84.45\% & 74.79\% \\ PGD Linf \(\epsilon=0.01\) & 88.64\% & 84.05\% & 86.61\% & 84.78\% & 73.89\% \\ PGD Linf \(\epsilon=0.015\) & 84.57\% & 77.20\% & 84.46\% & 81.45\% & 65.54\% \\ CW L2 \(\epsilon=1\) & 94.78\% & 95.25\% & 89.53\% & 91.28\% & 93.94\% \\ DeepFool L2 \(\epsilon=0.6\) & 88.54\% & 87.10\% & 85.03\% & 84.20\% & 80.31\% \\ DeepFool L2 \(\epsilon=0.8\) & 85.73\% & 82.75\% & 82.65\% & 81.19\% & 75.53\% \\ DeepFool Linf \(\epsilon=0.01\) & 90.33\% & 88.21\% & 85.42\% & 85.23\% & 80.42\% \\ DeepFool Linf \(\epsilon=0.015\) & 86.03\% & 82.66\% & 82.16\% & 80.44\% & 74.92\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Defense effects of different grid sizes with mask rate of 3/4 on VGG16 and CIFAR-10 dataset. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Attack Method** & **Attack** & **Defense** & **Improvement** \\ \hline Benign & & & 82.65\% \\ \hline FGSM L1 \(\epsilon\) = 15 & 35.48\% & 82.63\% & 47.15\% \\ FGSM L1 \(\epsilon\) = 20 & 33.02\% & 79.25\% & 46.23\% \\ FGSM L2 \(\epsilon\) = 0.3 & 38.29\% & 84.62\% & 46.33\% \\ FGSM L2 \(\epsilon\) = 0.4 & 35.27\% & 81.89\% & 46.62\% \\ FGSM Linf \(\epsilon\) = 0.01 & 33.02\% & 81.05\% & 48.03\% \\ FGSM Linf \(\epsilon\) = 0.02 & 28.27\% & 68.77\% & 40.50\% \\ BIM L1 \(\epsilon\) = 10 & 10.23\% & 84.71\% & 74.48\% \\ BIM L1 \(\epsilon\) = 15 & 6.70\% & 80.91\% & 74.21\% \\ BIM L2 \(\epsilon\) = 0.3 & 9.43\% & 83.21\% & 73.78\% \\ BIM L2 \(\epsilon\) = 0.4 & 8.06\% & 80.88\% & 72.82\% \\ BIM Linf \(\epsilon\) = 0.01 & 3.16\% & 81.80\% & 78.64\% \\ BIM Linf \(\epsilon\) = 0.015 & 1.06\% & 77.06\% & 76.00\% \\ PGD L1 \(\epsilon\) = 15 & 8.75\% & 85.44\% & 76.69\% \\ PGD L1 \(\epsilon\) = 20 & 6.36\% & 83.48\% & 77.12\% \\ PGD L2 \(\epsilon\) = 0.3 & 12.47\% & 86.42\% & 73.95\% \\ PGD L2 \(\epsilon\) = 0.4 & 9.01\% & 84.45\% & 75.44\% \\ PGD Linf \(\epsilon\) = 0.01 & 6.13\% & 84.78\% & 78.65\% \\ PGD Linf \(\epsilon\) = 0.015 & 2.30\% & 81.45\% & 79.15\% \\ CW L2 \(\epsilon\) = 1 & 15.89\% & 91.28\% & 75.39\% \\ DeepFool L2 \(\epsilon\) = 0.6 & 34.64\% & 84.20\% & 49.56\% \\ DeepFool L2 \(\epsilon\) = 0.8 & 31.81\% & 81.19\% & 49.38\% \\ DeepFool Linf \(\epsilon\) = 0.01 & 35.72\% & 85.23\% & 49.51\% \\ DeepFool Linf \(\epsilon\) = 0.015 & 32.26\% & 80.44\% & 48.18\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Defense against adversarial attacks by MAD on VGG16 and CIFAR-10 dataset.