Essential Features: Content-Adaptive Pixel Discretization to Improve
  Model Robustness to Adaptive Adversarial Attacks
  Preprocessing defenses such as pixel discretization are appealing to remove
adversarial attacks due to their simplicity. However, they have been shown to
be ineffective except on simple datasets such as MNIST. We hypothesize that
existing discretization approaches failed because using a fixed codebook for
the entire dataset limits their ability to balance image representation and
codeword separability. We propose a per-image adaptive preprocessing defense
called Essential Features, which first applies adaptive blurring to push
perturbed pixel values back to their original value and then discretizes the
image to an image-adaptive codebook to reduce the color space. Essential
Features thus constrains the attack space by forcing the adversary to perturb
large regions both locally and color-wise for its effects to survive the
preprocessing. Against adaptive attacks, we find that our approach increases
the $L_2$ and $L_\infty$ robustness on higher resolution datasets.
