Robust attention ranking architecture with frequency-domain transform to defend against adversarial samples

Abstract

Deep neural networks have powerful capabilities, but they are vulnerable to adversarial attacks. For image classification tasks, if a small disturbance is introduced into the input image, the model is likely to be misled and causes misclassification. In this paper, we develop a robust attention ranking architecture with frequency-domain transform to defend against adversarial samples, which is called RARFTA. We import the discrete cosine transform as the activation layer after the first convolutional layer, which effectively suppresses the attack based on the gradient method. To eliminate the interference of residual adversarial noise, we dynamically select key points from the feature map for classification with the attention mechanism to reduce the impact of other attacked pixels. Experimental results on different datasets show that our method is superior to the existing defense methods in both black-box and white-box attacks and significantly improves the robustness of the deep neural network model. The code for our work is available at https://github.com/lixiaowenaaa/RARTFA/tree/master.