# A Mask-Based Adversarial Defense Scheme
## 3 Materials and Methods
### Basic Settings for Adversarial Attack and Defense  
The experiments are based on TensorFlow 2.6 and completed on a server running Ubuntu 18.04 LTS with a NVIDIA GeForce RTX 3090 GPU. The Adam optimizer is used in the training phase with a learning rate 0.001. We choose three popular DNN models (LeNet with MNIST [25], VGG16 [26] with CIFAR-10 [23], and ResNet18 [27] with SVHN [24]). In order to achieve a classification accuracy close to its corresponding DNN model on benign (clean) images, for each original image input, we take the most favored class of all 5 tests as the output prediction. Foolbox [28] is used to generate adversarial samples for the test set. We leave the parameters of all adversarial attack methods as their default settings, except for the perturbation degree \(e\), which is specified in the \"Attack method\" column of the tables. Note that for all experiments in this paper, adversarial samples are generated only from benign images that are correctly classified by the DNNs. The adversarial attack algorithms also take into account the parameters of the MAD model. The generated adversarial samples aim to lower the accuracy of the MAD model without masking, e.g., the FGSM L1 with \(e=10\) attack results in the original LeNet model with 44.12% accuracy. When multiple randomized masking is applied at testing, the accuracy of the MAD model becomes 68.94% (with 24.82% improvement) facing adversarial samples. In this process, we generate adversarial images directly to attack the MAD model without masking. We believe this is a reasonable setting as an attacker would not be able to know which grids from an original input image are to be masked ahead of time, and the possible ways of random masking to a given input are exponential in size of the image (i.e., \(2^{|G|}\) where \(|G|\) is the number of grids, which is linear in size of the input). Although it is possible that all grids are masked and all information is lost from input, this is in general regarded as unlikely to happen, and most randomly masked images have their actual mask rates close to the set value, which is 3/4 in most of the experiments in the paper. Our discussion on the choice of mask rate is given in Section 4.2. For our experiment on the comparison, the implementations of denoised smoothing [[https://github.com/microsoft/denoised-smoothing](https://github.com/microsoft/denoised-smoothing)]([https://github.com/microsoft/denoised-smoothing](https://github.com/microsoft/denoised-smoothing)) (accessed on 9 November 2022) and PCL [[https://github.com/aamir-mustafa/pcl-adversarial-defense](https://github.com/aamir-mustafa/pcl-adversarial-defense)]([https://github.com/aamir-mustafa/pcl-adversarial-defense](https://github.com/aamir-mustafa/pcl-adversarial-defense)) (accessed on 9 November 2022) are publicly available from their respective authors, and the codes for the MagNet and Parseval networks are available from a third party, [PERSON] [[https://github.com/[PERSON]/MagNet.pytorch](https://github.com/[PERSON]/MagNet.pytorch)]([https://github.com/[PERSON]/MagNet.pytorch](https://github.com/[PERSON]/MagNet.pytorch)) (accessed on 9 November 2022) and the Python library _parsnet_[[https://github.com/mathialo/parsnet](https://github.com/mathialo/parsnet)]([https://github.com/mathialo/parsnet](https://github.com/mathialo/parsnet)) (accessed on 9 November 2022), respectively.