# Improving the Robustness of Model Compression by On-Manifold Adversarial Training
## 2 Related Works
### Defense against Adversarial Attacks  
There are various existing works on defense techniques against adversarial attacks. For convenience, we divide them largely into four categories: heuristic-based, detection-based, certified defense, and adversarial training. Heuristic-based methods include defensive distillation [PERSON] et al. (2015), which utilizes the idea of knowledge distillation [PERSON] et al. (2015) to make the model less sensitive to small perturbations in input. Another example is the logit pairing [PERSON] et al. (2015) method that enforces logits for pairs of benign examples and their adversarial counterparts to be similar.  
Detection-based defenses attempt to reject adversarial examples by detecting them. Feature squeezing [PERSON] et al. (2015) is a well-known method, which detects adversarial examples by comparing the model's prediction on the original samples with that on the transformed samples, where the transformations exhibit invariance in normal samples. [PERSON] et al. [PERSON] et al. (2016) used a sub-classifier for the detection of adversarial examples, and [PERSON] et al. [PERSON] et al. (2017) detected adversarial examples based on the property that adversarial examples lie outside of a learned manifold, using kernel density estimation and uncertainty measures.  
In certified defense, [PERSON] et al. [PERSON] et al. (2017) suggested to jointly optimize the differentiable certificate that no attack can force the error to exceed a certain threshold for a given network and test inputs. This work has been extended to use generative methods, such as VAE and GAN [PERSON] et al. (2017); [PERSON] et al. (2017); [PERSON] et al. (2017). More recently, [PERSON] et al. [PERSON] et al. (2018) proposed a defense method named TRADES, which combines the prediction error for the adversary with the original classification error and provides an differentiable upper bound. This is one of the state-of-the-art defense mechanism against adversarial attacks.  
Adversarial training (AT) is based on robust optimization [PERSON] et al. (2017) where the training is performed not only on the training samples but also on the worst-case adversarial examples. The early works include FGSM-AT [PERSON] et al. (2016), which incorporates FGSM adversarial examples during the training stage, PGD-AT Madry et al. (2018), and curriculum adversarial training [PERSON] et al. (2018). Recently, some studies have considered adversarial examples that lie on the data manifold. [PERSON] et al. [PERSON] et al. (2019) and [PERSON] et al. [PERSON] et al. [PERSON] et al. (2019) demonstrate that it is possible to generate adversarial examples that are the adversaries that can possibly lie on a data manifold embracing the observed data instances through manipulating the latent variable using generative models.  
In the case of defense against these on-manifold adversarial examples, [PERSON] et al. [PERSON] et al. (2019) suggested on-manifold adversarial training and showed that on-manifold adversarial training boosts generalization. More recently, dual manifold adversarial training (DMAT) [PERSON] et al. (2019) was proposed as a defense mechanism against both on-manifold adversarial examples and off-manifold adversarial examples by combining off-manifold adversarial training and on-manifold adversarial training.