Combating Adversaries with Anti-adversaries

Deep neural networks are vulnerable to small input perturbations known as adversarial attacks. Inspired by the fact that these adversaries constructed iteratively minimizing confidence of a network for true class label, we propose anti-adversary layer, aimed at countering this effect. In particular, our layer generates an perturbation in opposite direction one and feeds classifier perturbed version input. Our approach is training-free theoretically supported. We verify effectiveness combining with both nominally robustly trained models conduct large-scale experiments from black-box adaptive attacks on CIFAR10, CIFAR100, ImageNet. significantly enhances model robustness while coming no cost clean accuracy.