Defending Against Adversarial Attacks via Neural Dynamic System
Abstract
Although deep neural networks (DNN) have achieved great success, their applications in safety-critical areas are hindered due to their vulnerability to adversarial attacks.
Some recent works have accordingly proposed to enhance the robustness of DNN from a dynamic system perspective.
Following this line of inquiry, and inspired by the asymptotic stability of the general nonautonomous dynamical system, we propose to make each clean instance be the asymptotically stable equilibrium points of a slowly time-varying system in order to defend against adversarial attacks.
We present a theoretical guarantee that if a clean instance is an asymptotically stable equilibrium point and the adversarial instance is in the neighborhood of this point, the asymptotic stability will reduce the adversarial noise to bring the adversarial instance close to the clean instance.
Motivated by our theoretical results, we go on to propose a nonautonomous neural ordinary differential equation (ASODE) and place constraints on its corresponding linear time-variant system to make all clean instances act as its asymptotically stable equilibrium points.
Our analysis suggests that the constraints can be converted to regularizers in implementation.
The experimental results show that ASODE improves robustness against adversarial attacks and outperforms the state-of-the-art methods.
Introduction
Deep neural networks (DNNs) have achieved great success in a range of tasks, including image recognition [1, 2], scene segmentation [3, 4, 5] and action recognition [6, 7].
However, their performance can be significantly affected by human-imperceptible perturbations that can drastically change the network’s output [8, 9].
This phenomenon seriously restricts the application of DNN in safety-critical fields such as automatic driving.
Recently, some methods have been proposed to defend against adversarial attacks from the perspective of dynamic systems.
The paper [10] proposes a time-invariant steady neural ODE (TisODE) to limit the evolution of the curves by forcing the integrand to be close to zero.
However, this approach does not guarantee that small perturbations of the initial point will lead to small perturbations in the output at time T .
To reduce perturbations on the initial point, SODEF [11] causes the extracted features to be located within a neighborhood of the Lyapunov-stable equilibrium points of the autonomous ODE.
However, there are still some drawbacks of SODEF: 1.
In the papers [1, 12, 13], the general dynamical system explicitly depends on the argument t and is referred to as a nonautonomous dynamical system.
However, SODEF only considers the autonomous case, which is simply a special class of ODE.
As shown in Figure 1 (a), Lyapunov stability only controls the perturbations of the input rather than eliminating the effects of perturbations; simply maintaining the perturbations may still lead
0 t 0 .0 .
.2 .z
( t ) } δ
RealTrend (a) Lyapunov stability for ˙
z
( t ) =0 .2 .5 .
0 t 0 .0 .
.2 .z
( t ) } δ
EquilibriumTrend
[Figure]
to the misclassification of SODEF.
SODEF ensures that the output of the extractor is located in the neighborhood of the Lyapunov-stable equilibrium points; thus, the performance of SODEF depends on the extractor.
Specifically, if the extracted features deviate from real features, SODEF would regard the false features as the Lyapunov-stable equilibrium points; accordingly, the perturbed input of neural ODE will converge to the incorrect features, which would lead to misclassification of
SODEF.
These are also the major difference between SODEF and our method.
To solve the problems, in this paper, we first divide the instances into clean instance x , perturbed instance (cid:101) x , and contaminated instance ˆ x , which are shown in Figure 2.
Instances in the yellow and blue region of the same ball naturally have the same label y .
Then, the vulnerability of DNN to perturbation can be illustrated as following:
The function f is constructed by DNN.
f makes correct prediction when the input instance is clean, but makes wrong prediction when the input is contaminated.
In other words, we have f ( x ) =
y and f (ˆ x ) ̸
= y .
Therefore, we make ˆ x converge to x by dynamic system to improve the robustness of DNN.
Compared with SODEF, we consider a more general nonautonomous case:
[Equation]
As shown in Figure 1 (b), asymptotic stability helps to reduce the perturbation as t increases.
Therefore we make each clean instance into an asymptotically stable equilibrium point and locate the perturbed instance in its neighborhood.
In order to do this, we transform the nonautonomous
ODE (1) into a time-variant linear state-space equation, as follows:
[Equation]
According to nonlinear dynamic system theory [14], (2) is exponentially stable if the nonautonomous
ODE (1) is a slowly varying system and the Jacobian matrix A to which each frozen system ˙
z ( t ) =
h ( z ( t ) , τ ) corresponds is exponentially stable.
This holds because if all eigenvalues of A have negative real parts, A is exponentially stable.
We use the Levy-Desplanques theorem [15] to add constraints to the elements of Jacobian matrix A to ensure that all eigenvalues of A have negative real parts.
We solve the stability of (1) by imposing constraints on its linearization.
Additionally, rather than applying neural ODE to the output of the extractor, we instead apply neural ODE directly on the instance x ∈ X to eliminate the effects of perturbations.
The process is also illustrated in Figure 2, where the perturbed instance x + δ converges to the clean instance x along the red trajectory.
Based on the theoretical analysis above, we propose a stable neural ODE (ASODE) with asymptotic stable equilibrium points for defending against adversarial attacks, and further construct an optimization formulation to make it satisfy the asymptotic stability.
Moreover, we conduct experiments to compare the robustness of ASODE with ODE-Net [12], TisODE-Net [10] and SODEF [11] under different adversaril attacks on the CIFAR-10 [16] and MNIST [17] datasets.
The results shows that ASODE outperforms the state-of-the-art SODEF.
Moreover, both ASODE and SODEF are far more robust than ODE-Net and TisODE-Net.
For example, compared with the state-of-the-art neural ODE network SODEF under PGD attack on the MNIST and CIFAR-10 datasets, our ASODE improves the classification accuracy of adversarial examples by 1 .
60% and 1 . 76% , respectively.
Furthermore, compared with the TisODE-Net on the same datasets under PGD attack, ASODE improves the classification accuracy of adversarial examples by 45 .
07% and 53 . 53% , respectively.
Related Work
Neural ODEs The relationship between the ODEs and neural networks has been illustrated by [12, 18].
The papers [19, 20, 21] regard residual networks as a form of explicit Euler discretization with a unit step size.
Based on this, various perspectives and methods from numerical analysis have been employed to improve the network architecture [18, 22], minimize memory overload [12], reduce training time [23], and facilitate adaptivity to other models (e.g., transformers [24]).
Adversarial Defense
Many methods have been proposed to improve the robustness of neural networks via training using different strategies, including Bayesian adversarial learning [25], various regularization [26, 27], adversarial training and its variants [28, 29, 30, 31].
Moreover, some works explore adversarial robustness from the perspective of the stability of the numerical ODE or dynamic system.
For example, [32] reduces feature noise using ODE to develop a robust architecture.
[13] proposes a new robust architecture, improving the robustness of the original residual network family via the implicit Euler method of ODE.
Among the works, [33] is the first work to use control theory and dynamic systems to improve robustness, which is different from our work in the types of nonlinear system and the inputs.
[34] uses the property of radial basis function (RBF) to improve the robust, not ODE.
In the work most closely related to ours, [11] designs a stable neural autonomous ODE with Lyapunov-stable equilibrium points for defending against adversarial attacks.
The Lyapunov-stability of the autonomous ODE ensures that the input features from the extractor with a small perturbation converge to the unperturbed input features.
We study a more general case called a nonautonomous system.
Based on this, we directly reduce the adversarial noise on the instance by ensuring that the perturbed instances are in the neighborhood of asymptotically stable equilibrium points of nonautonomous ODE.
Therefore, we purify the sample and improve the network robustness.
Preliminaries
Let D be a probability distribution over X × Y , where X is the instance domain set and Y is the set of labels.
( x n , y n ) is sampled from D , where x n ∈ R d , y n ∈ R m and n = 1 , 2 , · · · , N .
D x is the marginal distribution of x over y .
h ( z ( t ) , t ) is a continuous function of R d × R + into R d ; here, t ∈ R + , R + = { t ∈ R : t ≥ 0 } , z ∈ R d , z ( t ) :
R + → R d .
Moreover, we use ∇ h ( z , t ) to denote its Jacobian at z .
C 1 represents the function with first-order derivative; || · || denotes the Euclidean norm; I is a d -dimensional vector in which each element is equal to 1 .
Finally,
B δ ( x ∗ ) = { x ∈ R d : || x − x ∗ || < δ } .
The d -dimensional instance x ∈ X can be seen as a point in the space R d .
However, as shown in Figure 3 (c), not every point of R d has the label y .
Figure 3 (b) is the perturbed Figure 3 (a), in which the perturbation can be arbitrarily small.
Figure 3 (b) naturally has the label " 6 " and is in the instance domain.
For each x ∈ X , there exists a continuous bounded neighborhood B δ ( x )
such that B δ ( x ) ⊂ X
and the instances in B δ ( x ) have the same label y .
Thus, the instance domain
X corresponds to the bounded ball cloud in R d , which is represented by the yellow balls in the coordinate space of Figure 2.
In addition, if we apply perturbation to each x ∈ X to form a new instance domain (cid:101) X the elements of which are denoted by (cid:101) x , then we can determine that (cid:101) X includes the adversarial samples and X ⊂ (cid:101) X .
We make D (cid:101) x
the marginal distribution of (cid:101) x over y .
These conclusions are directly demonstrated in the magnified ball of Figure 2.
Based on the analysis of this magnified ball, we define a clean instance for x ∈ X , perturbed instance for (cid:101) x ∈ (cid:101) X , and contaminated instance for ˆ x ∈ { (cid:101) x : (cid:101) x ∈ (cid:101) X , (cid:101) x / ∈ X} .
[Figure]
Consider a nonautonomous initial value ODE problem,
[Equation]
Suppose the function h satisfies a global Lipschitz condition [14, section 2.4.2], then, the solution of (3) is exist and unique over t ∈ [0 , ∞ ) .
The solution of (1) is denoted as z ( t ) with input z (0) and output z ( T ) .
In (3), z 0 is the initial value of z ( t ) at t = t 0 .
If t = t 0 = 0 , we have z (0) =
z
= x .
Meanwhile, let s ( z 0 , t 0 , t ) denote the solution of (3) corresponding to the initial input z 0 at t 0 .
For simplicity, we use s ( x , t ) to denote s ( z 0 , 0 , t ) .
Obviously, if the initial value for ODE (1) is given by z (0) =
x , the two representations are equivalent, and we have z ( t )
= s ( x , t ) , z (0)
=
s ( x , 0)
= x , z ( T ) =
s ( x , T ) .
Definition 1 (Equilibrium [14])
A vector x ∗ is said to be an equilibrium of (1)
if, h ( x ∗ , t ) = 0 , ∀ t ≥ 0 .
According to Definition 1, for any given x ∈ X , if the solution of (3) is z ( t ) =
x , t ≥ 0 , then h ( x , t ) =
d x dt = 0 , and x is an equilibrium of (1).
On the other hand, if x is an equilibrium, (1) has the unique solution z ( t ) = x , t ≥ 0 for the initial value z (0) = x .
In other words, if a system starts in an equilibrium, it remains in that state thereafter.
Definition 2 (Stability [35])
A constant vector x ∗ ∈ R d is a stable equilibrium point for (1) if, for each ϵ > 0 and each t 0 ∈ R + , there exists δ ( ϵ, t 0 ) such that for each z 0 ∈
B δ ( x ∗ ) , || s ( z 0 , t 0 , t ) − x ∗ || <
ϵ , ∀ t ≥ t 0 .
As shown in Figure 1 (a), whose ODE is ˙ z ( t ) = 0 with z (0) =
x ∈ X (here, x =1), for each ϵ > 0 , there exists δ <
ϵ d I such that || s ( x + δ, t ) − x
|| =
|| x
+ δ − x ||
=
|| x
+ ϵ d
I − x || < ϵ .
Therefore, x ∈ X is the stable equilibrium point of ODE (1) and also the Lyapunov-stable equilibrium point.
Definition 3 (Attractivity [35])
A constant vector x ∗ ∈ R d is an attractive equilibrium point for (1) if for each t 0 ∈ R + , there exists δ ( t 0 ) > 0 such that for each z 0 ∈
B δ ( x ∗ ) , lim t → + ∞ || s ( z 0 , t 0 , t ) − x ∗ || = 0 .
Definition 4 (Asymptotic stability [35])
A constant vector x ∗ ∈ R d is asymptotically stable if it is both stable and attractive.
It is worth noting that if an equilibrium is exponentially stable, it is also asymptotically stable with exponential convergence.
As shown in Figure 1, x = 1 in Figure 1 (b) is an attractive equilibrium point, but x = 1 in Figure 1 (a) is not.
Moreover, x = 1 is also asymptotically stable in Figure 1 (b).
Based on the notation above, we aim to make the contaminated instance ˆ x converge to the clean instance x .
In order to accomplish this evolution, we impose constraints on the ODE (1) to output z ( T ) =
x when the input is z (0) =
ˆ x ∈ B δ ( x ) .
In order to let lim t → + ∞ || s (ˆ x , t ) − x ||
=
0 , where ˆ x ∈ B δ ( x ) , we make all x ∈ X the asymptotically stable equilibrium points.
Theorem 1 Suppose the perturbed instance (cid:101) x is produced by adding perturbation smaller than δ on the clean instance.
If all the clean instances x ∈ X are the asymptotically stable equilibrium points of ODE (1), there exists δ > 0 , for each contaminated instance ˆ x ∈ { (cid:101)
x : (cid:101) x ∈ (cid:101) X , (cid:101) x / ∈ X} , there exists x ∈ X
such that lim t → + ∞ || s (ˆ x , t )
− x || = 0 .
See proof in Appendix A.1.
Theorem 1 guarantees that if we make clean instance x into the asymptotically stable equilibrium point, nonautonomous ODE can shrink the perturbation and make the perturbed instance approach to the clean instance, which could help improve the robustness of the DNN and aid the DNN in defending against adversarial attack.
Next, we talk about how to ensure the ODE has asymptotic stability.
Linearization and Stability of ODE
In order to make the nonautonomous ODE (1) have asymptotic stability, we linearize ODE (1) using
Lyapunov’s linearization method.
We then impose constraints on the linearization to make ODE (1) asymptotically stable.
Suppose x ∗ is an equilibrium point of nonautonomous systems (1),
[Equation]
where h is a C 1 function.
We define
[Equation]
Then, by the definition of the Jacobian, it follows that for each fixed t ≥ 0 , it is true that
[Equation]
However, it may not be true that
[Equation]
In other words, the convergence in (7) may not be uniform in t .
Provided that (8) holds, the system
[Equation]
is referred to as the linearization of (1) around the equilibrium x ∗ .
Theorem 2 Suppose that (4) holds and h ( z , t ) is continuously differentiable.
Define A ( t ) , h r ( z , t ) as in (5), (6), respectively, and assume that (8) holds and A ( t ) is bounded.
If x ∗ is an exponentially stable equilibrium of the linear system (9), then it is also an exponentially stable equilibrium of the system (1).
See proof in Appendix A.2.
In order to make all the equilibrium points of (9) asymptotically stable, we deduce the stability of the nonautonomous system (1) by studying only the "frozen" systems; that is, the ODE (1) with time "frozen" at r .
In other words, if r ∈ R + is any fixed number, we can think of the autonomous system
[Equation]
If x ∗ is the equilibrium point, then A =
[ ∂ h ( z ,r ) ∂
z ]
z = x ∗ is a constant matrix and the linearization (9) becomes ˙ z ( t ) =
A ( z − x ∗ ) .
Moreover, we use s r ( x , t ) to denote the solution of frozen system (10), starting at time 0 and state x , and evaluated at time t .
Even if each of the frozen systems (10) is exponentially stable, the overall system can be unstable [14].
Next, we will prove that if each frozen system is exponentially stable and the system is slowly varying, the overall system is indeed exponentially stable.
Theorem 3 Suppose ( i ) h is C 1 , h
( x ∗ , t )
= 0 , ∀ t ≥ 0 , and ( ii ) sup z ∈ R n sup t ≥
||∇ [Equation] z − x ∗ , t ) ||
= η < ∞ , ( iii ) there exist constants µ , δ such that | s r ( z − x ∗ , t [Equation] | [Equation]
, ∀ [Equation] ≥ 0 , ∀ z ∈ R n , ∀ r ∈ R + . ( iv ) suppose there is a constant ϵ > 0 such that
[Equation]
Then the nonautonomous systems (1) is exponentially stable provided ϵ <
δ [( p − 1) δ − η ] pµ p , where p >is any number such that ( p − 1) δ − η > 0 .
See proof in Appendix [-A.
-]A.
Based on Theorems 2 and 3, we impose constraints on ODE (1) to be a slowly varying systems and linearize it to be (9).
In order to make (9) stable, we transform the study of nonautonomous system (1) to the study of autonomous system (10); in other words, we should make ˙
z
( t ) =
A ( z − x ∗ ) asymptotically stable.
The following two theorems provide ideas for solving this problem.
Theorem 4 ([14])
The equation ˙ z ( t ) =
Az is asymptotically stable if and only if all eigenvalues of
A have negative real parts.
Theorem 5 (Levy–Desplanques theorem [15]) Let A =
[ a ij ] ∈ M n , if | a ii | ≥ (cid:80) i ̸
=
j | a ij | and a ii ≤ 0 for all i = 1 , · · · n , then every eigenvalue of A has a negative real part.
According to theorem 4, we need to make all eigenvalues of each Jabobian matrix A of (10) at equilibrium points have negative real parts.
In addition, in the light of the Levy–Desplanques theorem [15], rather than computing the eigenvalues, we instead add constraints to the elements of Jacobian matrix A to make all its eigenvalues have negative real parts.
Finally, we make all equilibrium points of the nonautonomous system (1) asymptotically stable by adding constraints on its linearization.
To sum up, we linearize the slowly varying nonautonomous ODE (1) and impose constraints on its linearization (9) to make all clean instances be the asymptotically stable equilibrium points of (1).
ASODE Architecture
This section proposes a stable neural ODE (ASODE) with asymptotically stable equilibrium points for defending against adversarial attacks.
To make all clean instances into the asymptotically stable equilibrium points of neural ODE, we construct an optimization problem according to the constraints mentioned in section 4.
To solve this optimization problem, we propose an objective with constraints imposed on its regularizer.
5.1 Architecture
Most physical systems are nonlinear and time-varying.
If we apply DNNs to dynamic systems, some of them can be described by nonlinear differential equations of the form,
[Equation]
where h θ is a neural ODE layer with parameter θ and defined as R d × R + → R d .
Similarly, f (cid:101) θ is a neural network with parameter (cid:101) θ and defined as R d → R m .
Because the evolutionary time of neural
ODE cannot be infinity, we set the final evolutionary time T and t ∈ [0 , T ] , where T is a positive integer.
Inspired by the neural dynamical forms, we propose the ASODE architecture and present it in Figure 4.
The ASODE can be simplified as follows: ODE + model.
The ODE part can be regarded as a denoiser, which helps to reduce the noise, including the adversarial noise, to rectify the perturbed instance x n + δ .
The output of ODE is a rectified instance z ( T ) =
x n when T is sufficiently large.
Subsequently, the rectified instance z ( T ) enters the grafted model f (cid:101) θ , and the final output label is not affected.
5.2 Asymptotic Stable Guarantee
As mentioned in section 3, we make all x ∈ X the asymptotically stable equilibrium points of neural
ODE (12).
According to the analysis in section 4, we transform the slowly time-varying ODE (12) to the linear time-varying state equation ˙ z ( t ) =
A ( t )( z ( t ) − x ) and simplify the nonautonomous system (12) to an autonomous system d z ( t ) dt
= h
θ ( z ( t ) , r ) .
We then make ˙
z
( t ) =
A ( z − x ) asymptotically stable, where A = [ ∂ h θ ( z ,r ) ∂
z ] z = x .
Next, we apply the Levy–Desplanques theorem to add constraints on the elements of Jacobian matrix A to make all its eigenvalues have negative real parts.
Therefore, we have the following optimization problem for the ODE part of ASODE:
[Equation]
∀ t ∈ [0 , T ] and i, j = 1 , 2 , · · · , d, where Φ is the cross-entropy loss, ϵ 1 and ϵ 2 are small constants, and I B δ ( x ) (
[Equation]
x
[Equation]
The optimization objective (14) can be illustrated as follows:
For any x ∈ X , if the perturbed instance (cid:101) x ∈ B δ ( x ) , we want the the neural ODE (12) to make (cid:101) x converge to x .
Therefore, our objective is to minimize the distance between s ( (cid:101) x , T ) and x .
The constraint (15) means that we set each x ∈ X as the asymptotically stable equilibrium point of neural ODE (12), which requires h θ ( x, t )
=
according to Definition 1.
The constraint (16) implies that we make the neural ODE
(12) the slowly time varying system, which requires || ∂ h θ ( z ,t ) ∂t || ≤ ϵ ||
z || according to the formulation (11) in Theorem 3.
The other conditions for Theorem 3 are implicitly satisfied when t is bounded.
Besides, the constraints (17) and (18) follows the Levy–Desplanques Theorem 5 to make neural ODE (12) asymptotically stable
5.3 Implementation
Rather than solving the optimization problem (14), we optimize the following empirical Lagrangian (24) with a training set ( x n , y n ) , n = 1 , 2 , · · · , N .
Moreover, x (1) n , x (2) n , · · · , x ( K ) n are K samples from B δ ( x n ) used to represent (cid:101) x .
In addition, τ = 0 , 1 , · · · , T − 1 are the discrete time points.
The correspondence and transformation between (14) and (24) are following:
[Equation]
The constraints (15), (16), (17) and (18) correspond to the discretization forms (20), (21), (22) and (23) respectively.
Furthermore, the objective (14) corresponds to (19).
Based on the analysis of the optimization problem (14)
[Equation] we get that the smaller the values (19)- (23) are, the better the neural ODE is. Therefore, we construct the following empirical loss L ODE :
[Equation]
According to our proposed ASODE, finding the optimal θ is the first phase in making the ODE (12) a good denoiser that is capable of reducing the adversarial noise.
We then fix the neural ODE (12) and train the grafted model as: min
[Equation]
[Equation]
f
[Equation]
T )) ,
[Equation]
Its empirical loss is L model :
[Equation]
In sum, our ASODE has two parts: the neural part plays the role of denoiser, and the grafted model has the ability of recognition.
In order to obtain the dynamic systems as we expected, we propose two related optimization problems (24) and (25).
Finally, we solve these two optimization problems (24) and (25) to make all the clean instances be the asymptotically stable equilibrium points of the neural ODE (12), thereby improving the robustness of our ASODE.
The pseudo code of ASODE algorithm is illustrated in Appendix B, which is from bringing the process above together.
Experiments
In this section, we conduct experiments on the CIFAR-10 [16] and MNIST [17] datasets to evaluate the robustness of ASODE under different adversarial attacks.
We follow the standard training, validation, and test splits in our experiments.
Moreover, we compare the robustness of ASODE with
ODE-Net [12], TisODE-Net [10], and SODEF [11].
6.1 Setup
We apply different attack methods to attack our model, namely FGSM [29] and PGD [28].
Following the same experimental settings as for SODEF, we implement the following settings.
For the
CIFAR-10 task, we use the model provided in [36]. 2.
For the MNIST task, we use the ResNet model provided in PyTorch.
The baselines are re-implemented according to the original paper.
The neural ODE function h θ is made up of three fully connected layers whose input and output layers have the same dimension.
During the training of ASODE, we first train the neural ODE for 50 epochs, after which we fix h θ and train f (cid:101) θ for another 100 epochs.
We set the parameters α 1 = 0 .
1 and α 2 = 0 .
05 when training ASODE.
In the below, the best results are marked in bold .
6.2 Performance Under PGD and FGSM Attacks
We evaluate the robustness of our ASODE under PGD attack and FGSM attack.
Specifically, we compare the robustness of ASODE with ODE-Net, TisODE-Net and SODEF on the MNIST and
CIFAR-10.
To facilitate fair comparison, we set T = 5 based on the original papers of the comparison models.
The results on MNIST and CIFAR-10 are presented in Table 1 and Table 2 respectively.
As the results show, under PGD and FGSM attacks, our model ASODE outperforms the state-of-the-art SODEF; moreover, ASODE also performs much better than ODE-Net and TisODE-Net.
For example, compared with SODEF under PGD attack on the MNIST and CIFAR-10, our ASODE improves the classification accuracy of adversarial examples by 1 .
60% and 1 . 76% respectively.
Furthermore, compared with TisODE-Net on the same datasets, the classification accuracy obtained by SODEF are increased by 45 .
07% and 53 . 53% respectively.
The “NO ODE” in Tables 1 and 2 corresponds to ASODE without the ODE part.
For ablation studies, we find that ASODE is more robust than NO ODE, which indicates that ODE part (12) helps improve the robustness.
[Table] [Table]
Conclusion
In this paper, we develope a novel nonautonomous time-slowing varying neural ODE, ASODE, that makes all clean instances be its asymptotically stable equilibrium points.
ASODE shrinks the adversarial noise and forces the adversarial instance to be close to the clean instance.
The experimental results show that ASODE improves the robustness against adversarial attacks and outperforms the state-of-the-art methods.
Acknowledgements
This work is supported by the National Natural Science Foundation of China under Grant 61976161.