Complete Defense Framework to Protect Deep Neural Networks against Adversarial Examples
Algorithm 1
The complete defense aware attack.
Input: a legitimate image ; adversarial example detection, adversarial perturbation cleaning and an adversarially trained targeted network denote as ,, and , respectively.
Parameter: the max attack iterations ( especially for single-step attack)Initialize for do(i) decides whether legitimate or adversarial image(i)If the decision is legitimate image, is updated by attacking (ii)If the decision is adversarial image, is updated by attacking the combination of and end
