Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks

Aamir Mustafa, Salman H. Khan, Munawar Hayat, Roland Goecke, Jiangbin Shen, Ling Shao

Research output: A Conference proceeding or a Chapter in BookConference contributionpeer-review

92 Citations (Scopus)


Deep neural networks are vulnerable to adversarial attacks, which can fool them by adding minuscule perturbations to the input images. The robustness of existing defenses suffers greatly under white-box attack settings, where an adversary has full knowledge about the network and can iterate several times to find strong perturbations. We observe that the main reason for the existence of such perturbations is the close proximity of different class samples in the learned feature space. This allows model decisions to be totally changed by adding an imperceptible perturbation in the inputs. To counter this, we propose to class-wise disentangle the intermediate feature representations of deep networks. Specifically, we force the features for each class to lie inside a convex polytope that is maximally separated from the polytopes of other classes. In this manner, the network is forced to learn distinct and distant decision regions for each class. We observe that this simple constraint on the features greatly enhances the robustness of learned models, even against the strongest white-box attacks, without degrading the classification performance on clean images. We report extensive evaluations in both black-box and white-box attack scenarios and show significant gains in comparison to state-of-the art defenses.
Original languageEnglish
Title of host publicationProceedinsg of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV 2019)
EditorsKyoung Mu Lee , David Forsyth, Marc Pollefeys, Xiaoou Tang
Place of PublicationUnited States
PublisherIEEE, Institute of Electrical and Electronics Engineers
Number of pages10
ISBN (Electronic)9781728148038
ISBN (Print)9781728148045
Publication statusPublished - 27 Oct 2019
Event2019 IEEE International Conference on Computer Vision - Seoul, Korea, Republic of
Duration: 27 Oct 20192 Nov 2019

Publication series

NameProceedings of the IEEE International Conference on Computer Vision
ISSN (Print)1550-5499


Conference2019 IEEE International Conference on Computer Vision
Abbreviated titleICCV 2019
Country/TerritoryKorea, Republic of
Internet address


Dive into the research topics of 'Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks'. Together they form a unique fingerprint.

Cite this