Adversarial Defenses via Vector Quantization
Zhiyi Dong Yongyi Mao
Building upon Randomized Discretization, we develop two novel adversarial
defenses against white-box PGD attacks, utilizing vector quantization in higher
dimensional spaces. These methods, termed pRD and swRD, not only offer a
theoretical guarantee in terms of certified accuracy, they are also shown, via
abundant experiments, to perform comparably or even superior to the current art
of adversarial defenses. These methods can be extended to a version that allows
further training of the target classifier and demonstrates further improved
performance.