A combination of noise and bilateral filters achieve supralinear and scalable adversarial robustness in CNNs
2026-06-01 • Machine Learning
Machine LearningComputer Vision and Pattern Recognition
AI summaryⓘ
The authors studied how two simple methods—adding random noise and smoothing images—can each help protect deep learning models from tricky attacks called adversarial examples. They found these two methods work better together than separately, making the model much tougher to fool without needing lots of extra computing power. By combining this approach with traditional training on attacks, their method performed very well on a standard benchmark while using much less training time and resources. Their work offers an easy and efficient way to make neural networks safer against attacks without complicated changes.
adversarial examplesdeep neural networksadversarial trainingGaussian noisebilateral filteringrobustnessAutoAttackRobustBenchcomputational efficiencysupralinear improvement
Authors
Nicolas Stalder, Benjamin F. Grewe, Matteo Saponati, Pau Vilimelis Aceituno
Abstract
The vulnerability of deep neural networks to adversarial examples poses a significant challenge for real-world deployment. Existing techniques to enhance deep network robustness rely on adversarial training, an approach that is powerful but computationally intensive and typically tailored to specific attack types. To address these limitations, existing works have explored techniques such as adding gaussian noise or filtering images, both of which can boost the network robustness to various adversarial attacks, albeit modestly. Here, we theoretically demonstrate that these two approaches enhance robustness against adversarial attacks through complementary mechanisms, resulting in supralinear robustness when combined. Building on this insight, we experimentally show that a simple preprocessor combining Gaussian noise and bilateral filtering yields supralinear improvements in adversarial robustness with minimal computational cost. Next, we combine our preprocessor with adversarial training and test on RobustBench to assess its supralinear improvement over state-of-the-art defenses. First, this combination ranks second on AutoAttack and third overall, while using only $\sim$35% of the training FLOPs, using a model with $\sim$50% less parametets, trained with $\sim$33% of the epochs and $\sim$15% the data compared to state-of-the-art defenses. Second, our method scales efficiently, matching the accuracy of competing models with roughly 2-8x less total compute across 3 orders of magnitude. Overall, our approach provides a principled and easily integrable framework for enhancing adversarial robustness, offering negligible computational overhead and a simple yet theoretically grounded design.