AI Defense Strategies Against Adversarial Attacks: A Practical Comparison

1️⃣ Why Did We Conduct This Experiment? Adversarial attacks pose a serious risk to AI models, leading them to make incorrect predictions even when small, imperceptible modifications are applied to input data. This vulnerability is particularly concerning in critical applications such as autonomous driving, medical diagnostics, and cybersecurity. Thus, we conducted this experiment to evaluate which defense strategies are effective at mitigating adversarial attacks, helping AI models remain robust against such threats. 2️⃣ What Is the Purpose of This Experiment? This experiment aims to answer the following questions: Which AI defense strategies are most effective against adversarial attacks? How does noise affect AI models, and which methods can mitigate it? Can simple image processing techniques significantly enhance model robustness? To explore these questions, we tested multiple AI defense strategies against adversarially perturbed images and compared their effectiveness. What is Noise in AI? Before diving into the defense strategies, it's important to understand what noise is in the context of AI security. Noise is any unwanted or disruptive alteration in an image, which can be natural or intentionally crafted to deceive AI models. Types of Noise Noise Type Description Example Gaussian Noise Random variations in pixel values, often appearing as grainy textures Low-light camera images Salt & Pepper Noise Random black and white pixels scattered throughout an image Old TV static Compression Artifacts Visual distortions caused by image compression techniques like JPEG Blurry text in low-quality images Adversarial Noise Carefully designed pixel modifications that are invisible to humans but mislead AI models AI misclassifies a panda as a gibbon How Noise Affects AI? Natural noise (like Gaussian noise) can degrade image quality but usually doesn't affect AI classification significantly. Adversarial noise is crafted specifically to trick AI models into making incorrect predictions. Defense strategies must be able to differentiate between natural and adversarial noise while maintaining classification accuracy. 3️⃣ Defense Strategies and Their Effectiveness Defense Strategy Effectiveness Strengths Weaknesses Gaussian Blur ❌ Almost Ineffective Simple, fast Reduces detail, doesn't remove adversarial noise JPEG Compression ✅ Most Effective Removes high-frequency noise May degrade image quality if overcompressed Bilateral Filter ⚠️ Moderately Effective Preserves edges while reducing noise Computationally expensive, still vulnerable to strong attacks Median Filter ⚠️ Partially Effective Works well for salt & pepper noise Not useful against stronger adversarial attacks Experiment Process: Applied adversarial noise to a dataset of images using perturbation techniques. Tested each defense strategy by applying it to the perturbed images. Compared the classification accuracy before and after applying each defense strategy. Analyzed the results to determine which strategy worked best. 4️⃣ Conclusion: Which Defense Strategy Works Best? JPEG Compression was the most effective defense strategy, as it removed high-frequency noise where adversarial perturbations typically exist. Gaussian Blur was almost completely ineffective, as it blurred the image without effectively mitigating adversarial perturbations. Bilateral Filter and Median Filter provided some level of defense, but they were not strong enough to counteract advanced adversarial attacks. Overall, JPEG Compression is recommended as the best image-based adversarial defense strategy in our experiment.

Feb 21, 2025 - 17:50

AI Defense Strategies Against Adversarial Attacks: A Practical Comparison

1️⃣ Why Did We Conduct This Experiment?

Adversarial attacks pose a serious risk to AI models, leading them to make incorrect predictions even when small, imperceptible modifications are applied to input data. This vulnerability is particularly concerning in critical applications such as autonomous driving, medical diagnostics, and cybersecurity.

Thus, we conducted this experiment to evaluate which defense strategies are effective at mitigating adversarial attacks, helping AI models remain robust against such threats.

2️⃣ What Is the Purpose of This Experiment?

This experiment aims to answer the following questions:

Which AI defense strategies are most effective against adversarial attacks?
How does noise affect AI models, and which methods can mitigate it?
Can simple image processing techniques significantly enhance model robustness?

To explore these questions, we tested multiple AI defense strategies against adversarially perturbed images and compared their effectiveness.

What is Noise in AI?

Before diving into the defense strategies, it's important to understand what noise is in the context of AI security. Noise is any unwanted or disruptive alteration in an image, which can be natural or intentionally crafted to deceive AI models.

Types of Noise

Noise Type	Description	Example
Gaussian Noise	Random variations in pixel values, often appearing as grainy textures	Low-light camera images
Salt & Pepper Noise	Random black and white pixels scattered throughout an image	Old TV static
Compression Artifacts	Visual distortions caused by image compression techniques like JPEG	Blurry text in low-quality images
Adversarial Noise	Carefully designed pixel modifications that are invisible to humans but mislead AI models	AI misclassifies a panda as a gibbon

How Noise Affects AI?

Natural noise (like Gaussian noise) can degrade image quality but usually doesn't affect AI classification significantly.
Adversarial noise is crafted specifically to trick AI models into making incorrect predictions.

Defense strategies must be able to differentiate between natural and adversarial noise while maintaining classification accuracy.

3️⃣ Defense Strategies and Their Effectiveness

Defense Strategy	Effectiveness	Strengths	Weaknesses
Gaussian Blur	❌ Almost Ineffective	Simple, fast	Reduces detail, doesn't remove adversarial noise
JPEG Compression	✅ Most Effective	Removes high-frequency noise	May degrade image quality if overcompressed
Bilateral Filter	⚠️ Moderately Effective	Preserves edges while reducing noise	Computationally expensive, still vulnerable to strong attacks
Median Filter	⚠️ Partially Effective	Works well for salt & pepper noise	Not useful against stronger adversarial attacks

Experiment Process:

Applied adversarial noise to a dataset of images using perturbation techniques.
Tested each defense strategy by applying it to the perturbed images.
Compared the classification accuracy before and after applying each defense strategy.
Analyzed the results to determine which strategy worked best.

4️⃣ Conclusion: Which Defense Strategy Works Best?

JPEG Compression was the most effective defense strategy, as it removed high-frequency noise where adversarial perturbations typically exist.
Gaussian Blur was almost completely ineffective, as it blurred the image without effectively mitigating adversarial perturbations.
Bilateral Filter and Median Filter provided some level of defense, but they were not strong enough to counteract advanced adversarial attacks.

Overall, JPEG Compression is recommended as the best image-based adversarial defense strategy in our experiment.