3 ms·

I wonder if adversarial attacks can be mitigated by simply passing a few transforms of the same image to the neural network.

• colechristensen 4y ago
  This is often a big part of how neural networks are trained. Take labelled photos (really it applies in abstract ways to other data) add a little noise, mirror, shrink and stretch, translate to a different area, etc. One piece of data becomes several training images. And no, this standard practice does not eliminate adversaries.
  • cuteboy19 4y ago
    No not while training, just ask the model to predict for a few transforms and get the mode. Simulating the fact that humans also have multiple frames worth of information about any object from slightly different angles
    • fjkdlsjflkds 4y ago
      This is actually a thing, yes (and it does increase robustness to adversarial examples). This is particularly useful if you apply (random) low-pass filtering (or denoising, or DCT-based compression, or anything that messes up high-frequency content) to the image (besides random cropping/rescaling), since adversarial examples often rely on manipulating (human-imperceptible) high-frequency information.