Original: Self-Supervised Iterative Contextual Smoothing for Efﬁcient Adversarial Defense against Gray- and Black-Box Attack
Revised: Self-Supervised Iterative Contextual Smoothing for Efﬁcient Adversarial Defense against Gray- and Black-Box Attack

Original: Abstract
Revised: Abstract

Original: We propose a novel and effective input transformation based adversarial defense method against gray- and black-box attack, which is computationally efﬁcient and does not require any adversarial training or retraining of a classiﬁcation model.
Revised: We propose a novel and effective input transformation based adversarial defense method against gray- and black-box attack, which is computationally efﬁcient and does not require any adversarial training or retraining of a classiﬁcation model.

Original: We ﬁrst show that a very simple iterative Gaussian smoothing can effectively wash out adversarial noise and achieve substantially high robust accuracy.
Revised: We ﬁrst show that a very simple iterative Gaussian smoothing can effectively wash out adversarial noise and achieve substantially high robust accuracy.

Original: Based on the observation, we propose Self-Supervised Iterative Contextual Smoothing (SSICS), which aims to reconstruct the original discriminative features from the Gaussian-smoothed image in context-adaptive manner, while still smoothing out the adversarial noise.
Revised: Based on the observation, we propose Self-Supervised Iterative Contextual Smoothing (SSICS), which aims to reconstruct the original discriminative features from the Gaussian-smoothed image in context-adaptive manner, while still smoothing out the adversarial noise.

Original: From the experiments on ImageNet, we show that our SSICS achieves both high standard accuracy and very competitive robust accuracy for the gray- and black-box attacks; e.g. , transferbased PGD-attack and score-based attack.
Revised: From the experiments on ImageNet, we show that our SSICS achieves both high standard accuracy and very competitive robust accuracy for the gray- and black-box attacks; e.g. , transferbased PGD-attack and score-based attack.

Original: A noteworthy point to stress is that our defense is free of computationally expensive adversarial training, yet, can approach its robust accuracy via input transformation.
Revised: A noteworthy point to stress is that our defense is free of computationally expensive adversarial training, yet, can approach its robust accuracy via input transformation.

Original: 1. Introduction
Revised: 1. Introduction

Original: Due to the vulnerability of deep neural networks to the adversarial attacks an “arms race” research between attack and defense methods has been recently pursued very actively.
Revised: Due to the vulnerability of deep neural networks to the adversarial attacks, an “arms race” research between attack and defense methods has been recently pursued very actively.

Original: Namely, when a method was proposed to defend against existing attack methods, it soon got broken by stronger new attacks and vice versa.
Revised: Namely, when a method was proposed to defend against existing attack methods, it soon got broken by stronger new attacks and vice versa.

Original: Among the proposed defense methods, the so-called adversarial training , which requires re-training of the networks from scratch to meet the robust performance criterion was shown to be the most robust against strong white-, gray- and black-box attacks (Dong et al., 2020).
Revised: Among the proposed defense methods, the so-called adversarial training , which requires re-training of the networks from scratch to meet the robust performance Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of criterion, was shown to be the most robust against strong white-, gray- and black-box attacks (Dong et al., 2020).

Original: However, the obvious drawback of such defense is that the re-training becomes computationally expensive for large training datasets or models.
Revised: However, the obvious drawback of such defense is that the re-training becomes computationally expensive for large training datasets or models.

Original: Input transformation based empirical defense methods (Dziugaite et al., 2016), on the other hand, simply transform the given input data in a way that the adversarial noise can be removed before it gets fed into the network; thus, re-training is not necessary.
Revised: Input transformation based empirical defense methods (Dziugaite et al., 2016), on the other hand, simply transform the given input data in a way that the adversarial noise can be removed before it gets fed into the network; thus, re-training is not necessary.

Original: However, early examples of those defense methods later on were shown to be largely broken by not only adaptive attacks, e.g. , (Carlini & Wagner, 2017) and (Madry et al., 2017), but also various kinds of strong grayand black-box attacks (Guo et al., 2017a;
Revised: However, early examples of those defense methods later on were shown to be largely broken by not only adaptive attacks, e.g. , (Carlini & Wagner, 2017) and (Madry et al., 2017), but also various kinds of strong grayand black-box attacks (Guo et al., 2017a;

Original: Dong et al., 2020).
Revised: Dong et al., 2020).

Original: Another line of work is the certiﬁed defense (Cohen et al., 2019), which also provides with robustness guarantees, and recently, (Salman et al., 2020) proposed a certiﬁed defense method that ﬁrst denoises the Gaussian noise-corrupted input data before passing it to the classiﬁcation network.
Revised: Another line of work is the certiﬁed defense (Cohen et al., 2019), which also provides with robustness guarantees, and recently, (Salman et al., 2020) proposed a certiﬁed defense method that ﬁrst denoises the Gaussian noise-corrupted input data before passing it to the classiﬁcation network.

Original: The method can be interpreted as performing a special form of input transformation, hence, did not require a re-training of the network as well.
Revised: The method can be interpreted as performing a special form of input transformation, hence, did not require a re-training of the network as well.

Original: However, while their method can give a certiﬁcate on the robust accuracy, its standard accuracy tends to deteriorate signiﬁcantly (as we show later).
Revised: However, while their method can give a certiﬁcate on the robust accuracy, its standard accuracy tends to deteriorate signiﬁcantly (as we show later).

Original: Inspired by (Salman et al., 2020), we propose a new input transformation based empirical defense method that can achieve both strong standard and robust accuracy against gray- and black-box attacks without any adversarial training or retraining of a classiﬁcation model.
Revised: Inspired by (Salman et al., 2020), we propose a new input transformation based empirical defense method that can achieve both strong standard and robust accuracy against gray- and black-box attacks without any adversarial training or retraining of a classiﬁcation model.

Original: To that end, we ﬁrst demonstrate that a very simple iterative Gaussian smoothing, which effectively washes out the adversarial noise, can achieve surprisingly high robust accuracy.
Revised: To that end, we ﬁrst demonstrate that a very simple iterative Gaussian smoothing, which effectively washes out the adversarial noise, can achieve surprisingly high robust accuracy.

Original: We then devise
Revised: We then devise

Original: Self-Supervised Iterative Contextual Smoothing (SSICS), which aims to iteratively reconstruct the original discriminative features from the Gaussian-smoothed image in a context-adaptive way, while still smoothing out the adversarial noise.
Revised: Self-Supervised Iterative Contextual Smoothing (SSICS), which aims to iteratively reconstruct the original discriminative features from the Gaussian-smoothed image in a context-adaptive way, while still smoothing out the adversarial noise.

Original: To realize such smoothing, we devise a new, efﬁcient version of blind-spot network (BSN) based on a recent work (Byun et al., 2021).
Revised: To realize such smoothing, we devise a new, efﬁcient version of blind-spot network (BSN) based on a recent work (Byun et al., 2021).

Original: As a result, we show that
Revised: As a result, we show that

Original: our
Revised: our

Original: SSICS, an input transformation-based defense, can almost approach the standard and robust accuracy of the adversarial training-based state-of-the-art defense method on the grayand black-box attacked ImageNet validation set.[Figure] [Figure] Adversarial Attack
Revised: SSICS, an input transformation-based defense, can almost approach the standard and robust accuracy of the adversarial training-based state-of-the-art defense method on the gray- and black-box attacked ImageNet validation set.

Original: Adversarial Defense with Iterative Smoothing

Original: [Figure]

Original: 2. Related Work Adversarial attack and defense
Revised: 2. Related Work Adversarial attack and defense

Original: After (Szegedy et al., 2013) revealed the vulnerability of neural networks, various papers have proposed different methods to attack the neural network (Madry et al., 2017; Goodfellow et al., 2014;
Revised: After (Szegedy et al., 2013) revealed the vulnerability of neural networks, various papers have proposed different methods to attack the neural network (Madry et al., 2017; Goodfellow et al., 2014;

Original: Kurakin et al., 2016; Andriushchenko et al., 2020).
Revised: Kurakin et al., 2016; Andriushchenko et al., 2020).

Original: Against these attacks, several papers proposed adversarial defense methods categorized by adversarial training (Shafahi et al., 2019; Xie et al., 2019) and input transformation (Guo et al., 2017b; Xu et al., 2017; Dziugaite et al., 2016;
Revised: Against these attacks, several papers proposed adversarial defense methods categorized by adversarial training (Shafahi et al., 2019; Xie et al., 2019) and input transformation (Guo et al., 2017b; Xu et al., 2017; Dziugaite et al., 2016;

Original: Xie et al., 2017).
Revised: Xie et al., 2017).

Original: However, input transformation methods are reported to easily be incapacitated by white-box attack (Dong et al., 2020).
Revised: However, input transformation methods are reported to easily be incapacitated by white-box attack (Dong et al., 2020).

Original: In more weak attack settings, such as gray- and blackbox attacks, (Guo et al., 2017b) suggested that input transformation with additional training achieves a comparative performance against adversarial examples from the attack scenarios.
Revised: In more weak attack settings, such as gray- and blackbox attacks, (Guo et al., 2017b) suggested that input transformation with additional training achieves a comparative performance against adversarial examples from the attack scenarios.

Original: However, these still show weakness in strong gray- and black-box attacks (Dong et al., 2020).
Revised: However, these still show weakness in strong gray- and black-box attacks (Dong et al., 2020).

Original: Related studies on blind-spot network are listed in Supplementary
Revised: Related studies on blind-spot network are listed in Supplementary

Original: Materials (SM).
Revised: Materials (SM).

Original: 3. Method 3.1. Preliminary and notations
Revised: 3. Method 3.1. Preliminary and notations

Original: Preliminary and notations We denote x ∈ R n as a clean image and x (cid:48) as an adversarial example constructed by the adversarial attack such as PGD (Madry et al., 2017).
Revised: Preliminary and notations We denote x ∈ R n as a clean image and x (cid:48) as an adversarial example constructed by the adversarial attack such as PGD (Madry et al., 2017).

Original: We assume that we have a pretrained classiﬁer f θ , which successfully predicts the label of the given input image x .
Revised: We assume that we have a pretrained classiﬁer f θ , which successfully predicts the label of the given input image x .

Original: However, f θ is vulnerable to an attacked image x (cid:48) in general.
Revised: However, f θ is vulnerable to an attacked image x (cid:48) in general.

Original: Note that we only consider gray-box attack and black-box attack.
Revised: Note that we only consider gray-box attack and black-box attack.

Original: For gray-box attack case, attacker can only access to the classiﬁer model, not to the defense method, and in blackbox attack case, an attacker do not know the information of both the classiﬁer and defense method.
Revised: For gray-box attack case, attacker can only access to the classiﬁer model, not to the defense method, and in blackbox attack case, an attacker do not know the information of both the classiﬁer and defense method.

Original: The goal of input transformation converting the input data x to ˆ x = T ( x ) is to maintain standard accuracy for the clean image x , while increasing robust accuracy for the attacked image x (cid:48) .
Revised: The goal of input transformation converting the input data x to ˆ x = T ( x ) is to maintain standard accuracy for the clean image x , while increasing robust accuracy for the attacked image x (cid:48) .

Original: FBI-Net Blind-spot Network (BSN) is designed for training a denoiser in an unsupervised way and FBI-Net proposed in (Byun et al., 2021) achieves the state-of-the-art blind denoising performance with very short inference time.
Revised: FBI-Net Blind-spot Network (BSN) is designed for training a denoiser in an unsupervised way and FBI-Net proposed in (Byun et al., 2021) achieves the state-of-the-art blind denoising performance with very short inference time.

Original: The reconstruction of i -th pixel of a given image x i of FBI-Net can be denoted as
Revised: The reconstruction of i -th pixel of a given image x i of FBI-Net can be denoted as

Original: [Equation]
Revised: [Equation]

Original: Note that a 0 is the output of BSN with parameter θ which receives x as an input image and returns a reconsturcted image, g θ ( x ) ∈ R n .
Revised: Note that a 0 is the output of BSN with parameter θ which receives x as an input image and returns a reconsturcted image, g θ ( x ) ∈ R n .

Original: However, it only utilizes the k × k patch surrounding x i (which excludes x i , denoted as C − i k × k ), as input patch for restoration ˆ x i .
Revised: However, it only utilizes the k × k patch surrounding x i (which excludes x i , denoted as C − i k × k ), as input patch for restoration ˆ x i .

Original: 3.2. Iterative smoothing for adversarial defense
Revised: 3.2. Iterative smoothing for adversarial defense

Original: The idea of using a variety of input transformation methods for adversarial defense was previously discussed in (Guo et al., 2017a).
Revised: The idea of using a variety of input transformation methods for adversarial defense was previously discussed in (Guo et al., 2017a).

Original: However, these methods require additional training procedure and still show weakness to strong grayand black-box attacks.
Revised: However, these methods require additional training procedure and still show weakness to strong grayand black-box attacks.

Original: Different from the previous methods, our model introduces an iterative pre-processing of the given input image ˆ x 0 , either for attacked and clean images x (cid:48) and x , as in,
Revised: Different from the previous methods, our model introduces an iterative pre-processing of the given input image ˆ x 0 , either for attacked and clean images x (cid:48) and x , as in,

Original: [Equation]
Revised: [Equation]

Original: Here, S ( · ) is a smoothing method and the number T denotes the number of iteration.
Revised: Here, S ( · ) is a smoothing method and the number T denotes the number of iteration.

Original: After the iterative pre-processing step, we feed ˆ x ( T ) to f θ for robust classiﬁcation against adversarial attack.
Revised: After the iterative pre-processing step, we feed ˆ x ( T ) to f θ for robust classiﬁcation against adversarial attack.

Original: The overall process is shown in Figure 1.
Revised: The overall process is shown in Figure 1.

Original: We note that Gaussian or median smoothing can be common solutions, and iterative smoothing is widely used for image denoising (Kumar & Sodhi, 2020).
Revised: We note that Gaussian or median smoothing can be common solutions, and iterative smoothing is widely used for image denoising (Kumar & Sodhi, 2020).

Original: In summary, we ﬁrstly apply iterative smoothing to adversarial defense and show that the effectiveness of the iterative smoothing on erasing adversarial perturbations in the attacked samples.
Revised: In summary, we ﬁrstly apply iterative smoothing to adversarial defense and show that the effectiveness of the iterative smoothing on erasing adversarial perturbations in the attacked samples.

Original: 3.3. Self-supervised iterative contextual smoothing
Revised: 3.3. Self

Revised: supervised iterative contextual smoothing

Original: Self-supervised training of FBI-Net Different from the usage of BSN in blind image denoising, we propose to train
Revised: Self-supervised training of FBI-Net Different from the usage of BSN in blind image denoising, we propose to train

Original: BSN in self-supervised manner by using mean squared error loss function, denoted as:
Revised: BSN in self-supervised manner by using mean squared error loss function, denoted as:

Original: [Equation]
Revised: [Equation]

Original: , where the clean image x is used as the input and target image, and ˆ x = g θ ( x ) .
Revised: , where the clean image x is used as the input and target image, and ˆ x = g θ ( x ) .

Original: One important thing to note is that[Figure] [Figure] the loss function can only be trained by BSN, due to the constraints of BSN on the input image x .
Revised: One important thing to note is that the loss function can only be trained by BSN, due to the constraints of BSN on the input image x .

Original: After training FBI-Net, the restored pixel ˆ x i of the given input x can be considered as the context-to-pixel smoothed result, because the restoration reconstructs the single pixel ˆ x i by utilizing the convolution using the patch information surrounding x i (but excluding x i ) and the trained parameter θ .
Revised: After training FBI-Net, the restored pixel ˆ x i of the given input x can be considered as the context-to-pixel smoothed result, because the restoration reconstructs the single pixel ˆ x i by utilizing the convolution using the patch information surrounding x i (but excluding x i ) and the trained parameter θ .

Original: Figure 2(a) shows the smoothing procedure by FBI-Net.
Revised: Figure 2(a) shows the smoothing procedure by FBI-Net.

Original: Expansion to context-to-context smoothing The limitation of context-to-pixel restoration is that it only considers a single pixel level restoration.
Revised: Expansion to context-to-context smoothing The limitation of context-to-pixel restoration is that it only considers a single pixel level restoration.

Original: It induces the quality degradation on restoration in non-local features.
Revised: It induces the quality degradation on restoration in non-local features.

Original: To overcome this limitation, we propose two simple tensor operations, patch-to-channel and channel-to-patch operation, to expand the restoration process from context-to-pixel to context-tocontext .
Revised: To overcome this limitation, we propose two simple tensor operations, patch-to-channel and channel-to-patch operation, to expand the restoration process from context-to-pixel to context-tocontext .

Original: As shown in Figure 2(b), the two operations are applied as a pre- and post-processing for FBI-Net respectively.
Revised: As shown in Figure 2(b), the two operations are applied as a pre- and post-processing for FBI-Net respectively.

Original: patch-to-channel transfers pixels of input image in P K × P K patches to channel-wise pixels and channel-to-context exactly operates as a reverse operation of context-to-channel . 
Revised: patch-to-channel transfers pixels of input image in P K × P K patches to channel-wise pixels and channel-to-context exactly operates as a reverse operation of context-to-channel . [Figure] [Figure] Adversarial Attack

Revised: Adversarial Defense with Iterative Smoothing

Original:  By adding these tensor operations, the restoration is simply expanded from context-to-pixel to context-to-context .
Revised: [Figure] [Figure] [Figure] By adding these tensor operations, the restoration is simply expanded from context-to-pixel to context-to-context .

Original: For example, Figure 2(b) illustrates that the red color patch (consisting of four pixels) is reconstructed from patch information of eight nearby patches.
Revised: For example, Figure 2(b) illustrates that the red color patch (consisting of four pixels) is reconstructed from patch information of eight nearby patches.

Original: As a result, it also can be considered as context-to-context smoothing using FBI-Net.
Revised: As a result, it also can be considered as context-to-context smoothing using FBI-Net.

Original: Combining Gaussian smoothing The level of difﬁculty is higher to reconstruct context-to-context than context-topixel , we combined Gaussian smoothing with the output of
Revised: Combining Gaussian smoothing The level of difﬁculty is higher to reconstruct context-to-context than context-topixel , we combined Gaussian smoothing with the output of

Original: FBI-Net.
Revised: FBI-Net.

Original: The restored ˆ x i is denoted as,
Revised: The restored ˆ x i is denoted as,

Original: [Equation]
Revised: [Equation]

Original: , where O and O r ( · ) denotes patch-to-channel and channelto-patch operation, and g θ is also trained by Equation (3).
Revised: , where O and O r ( · ) denotes patch-to-channel and channelto-patch operation, and g θ is also trained by Equation (3).

Original: During training, g θ learns to reconstruct the residual between a target image and GS ( x ) , and then it can be applied to iterative smoothing proposed in Equation (2) as the smoothing function S ( · ) .
Revised: During training, g θ learns to reconstruct the residual between a target image and GS ( x ) , and then it can be applied to iterative smoothing proposed in Equation (2) as the smoothing function S ( · ) .

Original: In conclusion, we call it as
Revised: In conclusion, we call it as

Original: Self-Supervised Iterative Contextual Smoothing (SSICS) and experimentally found that, our SSICS not only well removes adversarial perturbations than Gaussian smoothing, but also maintains discriminative features for classiﬁcation during iterative steps.
Revised: Self-Supervised Iterative Contextual Smoothing (SSICS) and experimentally found that, our SSICS not only well removes adversarial perturbations than Gaussian smoothing, but also maintains discriminative features for classiﬁcation during iterative steps.

Original: 4. Experimental Results 4.1. Experimental settings
Revised: 4. Experimental Results 4.1. Experimental settings

Original: Adversarial attack Following the experimental setting of (Xie et al., 2019), we evaluate all the baselines and the proposed method using PGD ( L ∞ and L 2 ) attack (Madry et al., 2017) on ImageNet validation dataset (Deng et al., 2009).
Revised: Adversarial attack Following the experimental setting of (Xie et al., 2019), we evaluate all the baselines and the proposed method using PGD ( L ∞ and L 2 ) attack (Madry et al., 2017) on ImageNet validation dataset (Deng et al., 2009).

Original: We used ImageNet pretrained ResNet152 (He et al., 2016) as the classiﬁcation model for entire experiments.
Revised: We used ImageNet pretrained ResNet152 (He et al., 2016) as the classiﬁcation model for entire experiments.

Original: The more details are introduced in SM.
Revised: The more details are introduced in SM.

Original: Evaluation metric and baselines
Revised: Evaluation metric and baselines

Original: As an evaluation metric, we report standard accuracy, which is average classiﬁcation accuracy for clean images, and robust accuracy, which is average classiﬁcation accuracy for adversarial examples.
Revised: As an evaluation metric, we report standard accuracy, which is average classiﬁcation accuracy for clean images, and robust accuracy, which is average classiﬁcation accuracy for adversarial examples.

Original: We select ﬁve defense methods as a baseline and FD (Xie et al., 2019), which is the state-of-the-art defense trained by adversarial training, as an empirical upper bound.
Revised: We select ﬁve defense methods as a baseline and FD (Xie et al., 2019), which is the state-of-the-art defense trained by adversarial training, as an empirical upper bound.

Original: The detailed description of baselines is introduced in SM
Revised: The detailed description of baselines is introduced in SM.

Original: [Table]

Original: 4.2. Gray-box attack
Revised: 4.2. Gray-box attack

Original: [Table]

Original: [Table]
Revised: [Table]

Original: Single gray-box PGD attack To compare baselines to
Revised: Single gray-box PGD attack To compare baselines to

Original: Gaussian smoothing (GS) and variants of SSICS, we evaluate all the baselines for gray-box attack.
Revised: Gaussian smoothing (GS) and variants of SSICS, we evaluate all the baselines for gray-box attack.

Original: we report the best result of each method in Table 1.
Revised: we report the best result of each method in Table 1.

Original: We generate adversarial examples using gray-box PGD L ∞ attack and evaluate all the methods using the adversarial examples.
Revised: We generate adversarial examples using gray-box PGD L ∞ attack and evaluate all the methods using the adversarial examples.

Original: For training all the variants of SSICS, only the 5% of ImageNet training dataset were used.
Revised: For training all the variants of SSICS, only the 5% of ImageNet training dataset were used [Table]

Revised: From the experimental results

Original: From the experimental results, ﬁrst, we can see that baselines of input transformation, such as, FS (Xu et al., 2017),
Revised: [Table] ﬁrst [Table] we can see that baselines of input transformation, such as, FS (Xu et al., 2017),

Original: TVM (Rudin et al., 1992) and JPEG (Dziugaite et al., 2016), could not successfully defend adversarial examples.
Revised: TVM (Rudin et al., 1992) and JPEG (Dziugaite et al., 2016) [Table] could not successfully defend adversarial examples.

Original: The observed failures are also demonstrated by previous works (Dong et al., 2020; Guo et al., 2017a).
Revised: The observed failures are also demonstrated by previous works (Dong et al., 2020; Guo et al., 2017a).

Original: Among them, TVM shows slightly better robust accuracy than others, but it requires long inference time.
Revised: Among them, TVM shows slightly better robust accuracy than others, but it requires long inference time.

Original: Second, we observe that DS(Salman et al., 2020) performance is highly dependent on
Revised: Second, we observe that DS

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original:  the level of Gaussian noise used for randomized smoothing.
Revised: (Salman et al., 2020) performance is highly dependent on the level of Gaussian noise used for randomized smoothing.

Original: Even though DS achieves an impressive standard and robust accuracy in σ = 0 .
Revised: Even though DS achieves an impressive standard and robust accuracy in σ = 0 .

Original: 12 , it takes long time to defend because of its noise sampling procedure.
Revised: 12 , it takes long time to defend because of its noise sampling procedure.

Original: Finally, we clearly observe that variants of SSICS and GS ( G K = 5 , t = 6 ) achieve the impressive result in both standard and robust accuracy compared to all baselines.
Revised: Finally, we clearly observe that variants of SSICS and GS ( G K = 5 , t = 6 ) achieve the impressive result in both standard and robust accuracy compared to all baselines.

Original: Epecially, newly proposed SSICS ( C K = 2 , P K = 11 , t = 7 ) maintains high standard accuracy, and also well defends adversarial examples with fast inference time.
Revised: Epecially, newly proposed SSICS ( C K = 2 , P K = 11 , t = 7 ) maintains high standard accuracy, and also well defends adversarial examples with fast inference time.

Original: It is worth highlighted in that our average accuracy is comparable to FD and overwhelms the other input transformation baselines, without adversarial training or re-training for the classiﬁcation model.
Revised: It is worth highlighted in that our average accuracy is comparable to FD and overwhelms the other input transformation baselines, without adversarial training or re-training for the classiﬁcation model.

Original: See SM for the additional results regarding a veriﬁcation of iterative smoothing.
Revised: See SM for the additional results regarding a veriﬁcation of iterative smoothing.

Original: Various gray-box PGD attacks The results in Figuredemonstrate that input transformation based methods such as JPEG and FS reveal weakness against strong gray-box attacks, as already shown in (Dong et al., 2020).
Revised: Various gray-box PGD attacks The results in Figuredemonstrate that input transformation based methods such as JPEG and FS reveal weakness against strong gray-box attacks, as already shown in (Dong et al., 2020).

Original: On the other hand, DS ( σ = 0 . 12) shows more robust performance to those attacks.
Revised: On the other hand, DS ( σ = 0 . 12) shows more robust performance to those attacks.

Original: Especially, it achieves a superior result in
Revised: Especially, it achieves a superior result in

Original: PGD L 2 but suffers from slow inference time than other baselines.
Revised: PGD L 2 but suffers from slow inference time than other baselines.

Original: Note that our SSICS shows consistent robust accuracy for all experiments, and even obtains comparable results to FD.
Revised: Note that our SSICS shows consistent robust accuracy for all experiments, and even obtains comparable results to FD.

Original: 4.3. Black-box attack
Revised: 4.3. Black-box attack

Original: We evaluate baselines and SSICS on two types of blackbox attack.
Revised: We evaluate baselines and SSICS on two types of blackbox attack.

Original: First, we consider transfer-based PGD attack (Dong et al., 2020) and set  model (Huang et al., 2017) to generate adversarial examples.
Revised: First, we consider transfer-based PGD attack (Dong et al., 2020) and set DenseNet201 as substitute model (Huang et al., 2017) to generate adversarial examples.

Original: Second, we select Square (Andriushchenko et al., 2020), which is the state-of-the-art score-based black-box attack.
Revised: Second, we select Square (Andriushchenko et al., 2020), which is the state-of-the-art score-based black-box attack.

Original:  Figure 4(a) and 4(b) show the experimental results of transfer-based PGD attack on various settings that were already proposed in previous section.
Revised: Transfer-based PGD attack Figure 4(a) and 4(b) show the experimental results of transfer-based PGD attack on various settings that were already proposed in previous section.

Original: Although other baselines show better robust accuracy than previous section, we clearly observe that GS and SSICS are more robust to variants of transfer-based PGD attacks, and only comparable to FD trained by adversarial training.
Revised: Although other baselines show better robust accuracy than previous section, we clearly observe that GS and SSICS are more robust to variants of transfer-based PGD attacks, and only comparable to FD trained by adversarial training.

Original: Score-based black-box attack We generate adversarial examples using Square (Andriushchenko et al., 2020) on various queries and evaluate the baselines and SSICS with them, as shown in Figure 4(c).
Revised: Score-based black-box attack We generate adversarial examples using Square (Andriushchenko et al., 2020) on various queries and evaluate the baselines and SSICS with them, as shown in Figure 4(c).

Original: It again shows that JPEG and FS are quite robust to score-based black-box attack than the other type of attacks, as also demonstrated in (Dong et al., 2020), but GS achieves relatively worse results than transfer-based PGD attack.
Revised: It again shows that JPEG and FS are quite robust to score-based black-box attack than the other type of attacks, as also demonstrated in (Dong et al., 2020), but GS achieves relatively worse results than transfer-based PGD attack.

Original: On the other hand, our SSICS maintains competitive robust accuracy for various levels of query compared to JPEG and FS.
Revised: On the other hand, our SSICS maintains competitive robust accuracy for various levels of query compared to JPEG and FS.

Original: 5. Concluding Remarks
Revised: 5. Concluding Remarks

Original: We propose SSICS that extends existing BSN to the context level and combines Gaussian smoothing.
Revised: We propose SSICS that extends existing BSN to the context level and combines Gaussian smoothing.

Original: As a result, we show simple iterative Gaussian smoothing and SSICS can robustly defend various gray- and black-box attacks without any adversarial training or re-training of a classiﬁcation model.
Revised: As a result, we show simple iterative Gaussian smoothing and SSICS can robustly defend various gray- and black-box attacks without any adversarial training or re-training of a classiﬁcation model.

Original: Our future work is to analyze the reason our SSICS can signiﬁcantly wash out adversarial perturbation, as well as maintain the discriminative feature for classiﬁcation.
Revised: Our future work is to analyze the reason our SSICS can signiﬁcantly wash out adversarial perturbation, as well as maintain the discriminative feature for classiﬁcation.

Original: 1. Additional Related Works
Revised: 1. Additional Related Works

Original: Blind-spot networks for blind image denoising The goal of blind image denoising is to train a denoiser network using only a single noisy image.
Revised: Blind-spot networks for blind image denoising The goal of blind image denoising is to train a denoiser network using only a single noisy image.

Original: The most dominant direction in blind image denoising is a blind-spot network (BSN) method.
Revised: The most dominant direction in blind image denoising is a blind-spot network (BSN) method.

Original: BSN restores each pixel by only the given context around the pixel, excluding the target pixel.
Revised: BSN restores each pixel by only the given context around the pixel, excluding the target pixel.

Original: After the success of BSN, many modiﬁed methods (Krull et al., 2019; Cha & Moon, 2018; 2019; Laine et al., 2019; Wu et al., 2020) have been proposed.
Revised: After the success of BSN, many modiﬁed methods (Krull et al., 2019; Cha & Moon, 2018; 2019; Laine et al., 2019; Wu et al., 2020) have been proposed.

Original: However, these methods commonly share the problem of time and cost inefﬁciency because of its inefﬁcient architecture.
Revised: However, these methods commonly share the problem of time and cost inefﬁciency because of its inefﬁcient architecture.

Original: Recently, (Byun et al., 2021) proposes the newly devised BSN, called as FBI-Net, which achieves the fastest inference time and the lowest
Revised: Recently, (Byun et al., 2021) proposes the newly devised BSN, called as FBI-Net, which achieves the fastest inference time and the lowest

Original: GPU memory usage than existing all baselines.
Revised: GPU memory usage than existing all baselines.

Original: 2. The Details on Experimental Settings
Revised: 2. The Details on Experimental Settings

Original: Baselines We select four input transformation based adversarial methods as baseline, abbreviated as FS(Xu et al., 2017), SS (Xu et al., 2017), JPEG (Dziugaite et al., 2016) and TVM (Rudin et al., 1992) proposed in (Guo et al., 2017).
Revised: Baselines We select four input transformation based adversarial methods as baseline, abbreviated as FS(Xu et al., 2017), SS (Xu et al., 2017), JPEG (Dziugaite et al., 2016) and TVM (Rudin et al., 1992) proposed in (Guo et al., 2017).

Original: The signiﬁcant difference to (Guo et al., 2017) is that we do not re-train the classiﬁer on a given transformation method for defense in all experiments.
Revised: The signiﬁcant difference to (Guo et al., 2017) is that we do not re-train the classiﬁer on a given transformation method for defense in all experiments.

Original: Also, we evaluate DS (Salman et al., 2020) as a representative of certiﬁed defense because it does not require any pre-training of classiﬁer, like our method.
Revised: Also, we evaluate DS (Salman et al., 2020) as a representative of certiﬁed defense because it does not require any pre-training of classiﬁer, like our method.

Original: We set the number of sampling for DS as n = 100 .
Revised: We set the number of sampling for DS as n = 100 .

Original: Finally, we select FD (Xie et al., 2019), which denotes an adversarially trained model, as an upper bound of defense.
Revised: Finally, we select FD (Xie et al., 2019), which denotes an adversarially trained model, as an upper bound of defense.

Original: We conducted experiments by implementing code in (Ding et al., 2019; Nicolae et al., 2018;
Revised: We conducted experiments by implementing code in (Ding et al., 2019; Nicolae et al., 2018;

Original: Kim, 2020), and downloaded weights of (Salman et al., 2020) and (Xie et al., 2019) from their ofﬁcial website.
Revised: Kim, 2020), and downloaded weights of (Salman et al., 2020) and (Xie et al., 2019) from their ofﬁcial website.

Revised: Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning.

Revised: Copyright 2021 by the author(s).

Original: Hyperparameter settings for PGD attack We used a speciﬁed (cid:15) and iter (number of steps for gradient update) for all experiments in the manuscript.
Revised: Hyperparameter settings for PGD attack We used a speciﬁed (cid:15) and iter (number of steps for gradient update) for all experiments in the manuscript.

Original: For α (the strength of update for each iteration), we set α = 16 / 255 .
Revised: For α (the strength of update for each iteration), we set α = 16 / 255 .

Original: when the number of steps (iter) is less than or equal to 10, α = (cid:15)/ 255 .
Revised: when the number of steps (iter) is less than or equal to 10, α = (cid:15)/ 255 .

Original: when the number of steps (iter) is greater than 10.
Revised: when the number of steps (iter) is greater than 10.

Original: Controlling σ for Gaussian smoothing For Gaussian smoothing (GS) (and also GS in SSICS), we set σ =
Revised: Controlling σ for Gaussian smoothing For Gaussian smoothing (GS) (and also GS in SSICS), we set σ =

Original: G K − 1 / 6 and only controls the kernel size G K as a hyperparameter.
Revised: G K − 1 / 6 and only controls the kernel size G K as a hyperparameter.

Original: 3. Additional Experimental Results
Revised: 3. Additional Experimental Results

Original: [Figure]
Revised: [Figure]

Original: Verifying iterative context smoothing We verify the advantage of iterative context smoothing for adversarial defense as shown in Figure 1.
Revised: Verifying iterative context smoothing We verify the advantage of iterative context smoothing for adversarial defense as shown in Figure 1.

Original: For that, we generate adversarial examples using gray-box PGD L ∞ ( (cid:15)
Revised: For that, we generate adversarial examples using gray-box PGD L ∞ ( (cid:15)

Original: = 16 , iters=10) attack and evaluate three types of smoothing, such as Gaussian, average and median smoothing with the kernel size of( K = 5 ), and SSICS.
Revised: = 16 , iters=10) attack and evaluate three types of smoothing, such as Gaussian, average and median smoothing with the kernel size of( K = 5 ), and SSICS.

Original: Note that we trained DnCNN (Zhang et al., 2017) and all variants of SSICS, in a self-supervised way, using only 5% of whole images in ImageNet training dataset.
Revised: Note that we trained DnCNN (Zhang et al., 2017) and all variants of SSICS, in a self-supervised way, using only 5% of whole images in ImageNet training dataset.

Original: From the results, we could ﬁnd out that, ﬁrstly, iterative context smoothing with GS ( K = 5 ) works better than other types of smoothings, such as AS and MS, in both standrand and robust accuracy.
Revised: From the results, we could ﬁnd out that, ﬁrstly, iterative context smoothing with GS ( K = 5 ) works better than other types of smoothings, such as AS and MS, in both standrand and robust accuracy.

Original: Especially, when we iterate GS ( K = 5 ) for 6 times, it achieves a superior accuracy in both cases.
Revised: Especially, when we iterate GS ( K = 5 ) for 6 times, it achieves a superior accuracy in both cases.

Original: Secondly, SSICS ( P K = 0 , G K = 0 ), which is equal to the original FBI-Net (Byun et al., 2021), obtain a better result at t = 5 than GS ( K = 5 ), however, it is sensitively degraded from t = 6 .
Revised: Secondly, SSICS ( P K = 0 , G K = 0 ), which is equal to the original FBI-Net (Byun et al., 2021), obtain a better result at t = 5 than GS ( K = 5 ), however, it is sensitively degraded from t = 6 .

Original: Thirdly, when we extend SSICS to context-to-context with P K = 2 , there is no degradation and it achieves the most superior standard and robust accuracy even than GS ( K = 5 ), in addition, if GS is used together,
Revised: Thirdly, when we extend SSICS to context-to-context with P K = 2 , there is no degradation and it achieves the most superior standard and robust accuracy even than GS ( K = 5 ), in addition, if GS is used together,

Original: SSICS ( P K = 2 , G K = 11 ) achieves a slight increase in both standard and robust accuracy at t = 7 .
Revised: SSICS ( P K = 2 , G K = 11 ) achieves a slight increase in both standard and robust accuracy at t = 7 .

Original: Finally, the result of DnCNN, which is trained by Equation (3) in the manuscript, demonstrates that the restoration model based on a pure convolutional neural network cannot be used for
Revised: Finally, the result of DnCNN, which is trained by Equation (3) in the manuscript, demonstrates that the restoration model based on a pure convolutional neural network cannot be used for

Original: SSICS.
Revised: SSICS.

Original: This is because there is no constraint for x i , which is discussed in Section 3.1 in the manuscript.
Revised: This is because there is no constraint for x i , which is discussed in Section 3.1 in the manuscript.

Original: Therefore,
Revised: Therefore,

Original: DnCNN trained by self-supervised learning perfectly returns the given input image directly, as a result, it achieves robust accuracy it had when defense was not applied.
Revised: DnCNN trained by self-supervised learning perfectly returns the given input image directly, as a result, it achieves robust accuracy it had when defense was not applied.