# A Mask-Based Adversarial Defense Scheme
## 3 Materials and Methods
### Mitigating Adversarial Attacks  
In our second step, we investigate how the new model trained for masked images can be used to boost defense against adversarial inputs. Given an adversarial input \(x^{\prime}=x+\delta\), the new model produces \(f_{\mathscr{G}}(x(x+\delta,c))\) with a randomly picked mask parameter \(c\). Let \(\delta^{\prime}=\tau(x+\delta,c)-\tau(x,c)\), which is the actual perturbation (vector) on the input to \(f_{\theta^{\prime}}\), and it is obvious that we have \(||\delta^{\prime}||_{p}\leq||\delta||_{p}\) for any \(p\) and any \(c\), since only unmasked pixels of \(x\) are affected by \(\delta\). As an example, suppose \(3/4\) of the input pixels are masked, the expected \(\ell_{1}\) norm of \(\delta^{\prime}\) is only about \(1/4\) in size of the \(\ell_{1}\) norm of the original perturbation \(\delta\). In order to measure how much the effect of adversarial inputs is weakened by masking, we conduct another preliminary study by randomly removing part of the perturbation vector \(\delta\) from an adversarial input. We first train a VGG16 model on CIFAR-10 data set by using the conventional method. Then, given adversarial samples generated from clean samples, we obtain each perturbation vector by taking the difference between an adversarial input and its corresponding clean image. These vectors are then randomly masked before  
Figure 2: The red line shows the relationship between test accuracy and number of repetitions for \(3/4\) masked images from CIFAR-10, and the green line shows the amount of time (in seconds) that is required to test 10,000 images. adding back to the clean images to form a set of weakened attack samples. The relationship between the model accuracy and the proportion of the remaining adversarial disturbance is shown in Figure 3, where 100% remaining adversarial disturbance represents strength of the original adversarial inputs, and 20% remaining represents the adversarial inputs with 80% of the perturbation dimensions removed. In particular, we find that the CW attack is more sensitive to this perturbation removal operation, which may be due to the fact that CW generates smaller perturbation with higher relevance. For most other attacks, we find that removing at least 60% of the perturbation (i.e., at most 40% of the attack perturbation remaining) is required to deliver significant improvement regarding classification accuracy. In general, there is often a tradeoff between the strength of defense and the degree of accuracy. As shown in Table 1 of our experiment in the next section, after fixing a network structure, increasing the percentage of masked pixels (at both the training and test phases) often results in a stronger defense against most of the tested adversarial attacks, but with less accurate classification results on benign (clean) inputs. For example, given the first FGSM attack with perturbation degree 15, setting a mask rate of 1/3 yields a model with defense accuracy of 70.17% on adversarial samples, which is less effective compared to the 85.3% accuracy when each grid has a 4/5 probability of being masked. However, the 4/5 masked model only has 76.14% accuracy on benign images, whereas the 1/3 masked model has 85.31% accuracy.