{'fraction_non_alphanumeric': 0.03408706352868789, 'fraction_numerical': 0.008214120904476234, 'mean_word_length': 4.6015853868688605, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Improving Robustness with Image Filtering

Adversarial robustness is one of the most challenging problems in Deep Learning and Computer Vision research. All the state-of-the-art techniques require a time-consuming procedure that creates cleverly perturbed images. Due to its cost, many solutions have been proposed to avoid Adversarial Training. However, all these attempts proved ineffective as the attacker manages to exploit spurious correlations among pixels to trigger brittle features implicitly learned by the model. This paper first introduces a new image filtering scheme called Image-Graph Extractor (IGE) that extracts the fundamental nodes of an image and their connections through a graph structure. By leveraging the IGE representation, we build a new defense method, Filtering As a Defense, that does not allow the attacker to entangle pixels to create malicious patterns. Moreover, we show that data augmentation with filtered images effectively improves the model's robustness to data corruption. We validate our techniques on CIFAR-10, CIFAR-100, and ImageNet.


Introduction
The present work was inspired by visual inspection of many adversarial example images. As can be appreciated in Figure 1, where adversarial examples related to CIFAR-10 are reported, the attack seeks to create spurious micro-patterns that, although perceptually negligible to humans, dramatically impact the behavior of Deep Neural Networks (DNNs) [26]. These artifacts give rise to many tailored 'virtual edges', which leverage structural properties of the DNN architecture (specifically, the sum-aggregation operation in convolutional layers and the increasing receptive field size in deeper layers) to excite specific internal model biases. As a result, the model predictions can be easily subverted, causing input samples to be misclassified with high confidence.
Indeed, current DNNs are strongly dependent on a fragile balance of features that, if broken, can lead to a significant drop in generalization power [11,28].
The fundamental strength of the micro-patterns introduced by adversarial attacks lies in their simultaneous local and non-local nature. Locality stems from the fact that the perturbation can be very precise in spatial location and directly impacts only strictly neighboring pixels. Non-locality, instead, emerges from the possibility to leverage the correlation among spatially distant pixels. In view of this, the attacker is allowed to be very precise in choosing the optimal (relative) spatial locations so that the malign effects of perturbations can conveniently accumulate across layers.
In recent years, many defenses against adversarial examples have been proposed. However, the vast majority of the proposed approaches proved to be ineffective under stronger attacks or adaptive ones, as their false sense of robustness turned out to be related to different forms of obfuscated gradients [1,27].
The most reliable method to truly enforce robustness in DNNs is represented by Adversarial Training (AT) [16], which consists in training DNNs on adversarial samples rather than natural ones. In these settings, the training process is induced to find a configuration of parameters so that the model is robust to adversarial examples. The spurious textures characterizing adversarial examples let the model infer that a peculiar configuration of a few distant pixels is, in principle, not correlated with the task or that a particular local texture is not predictive. As this process takes place during training, the model can adapt its parameters accordingly.
As mentioned above, many issues related to the correlation of spatially distant pixels are due to the model architecture itself rather than the training procedure or the training data. Therefore, major enhancements in adversarial robustness should come from novel architecture layouts taking into account the structural weaknesses discussed above. However, significant improvements can still be achieved by acting on the input space.
Based on the above intuitions, this paper presents a novel image filtering framework aimed at improving robustness against adversarial attacks without resorting to AT. While it is not the first contribution introducing techniques based on input manipulation to prevent adversarial attacks [7,9,15], this work differs significantly from prior literature in the fundamental concepts at the basis of its functioning. The main difference between our method and others relying on input transformations is that we explicitly remove textures from input images while preserving the informative features. This is achieved through an iterative filtering procedure based on simple rules that do not require additional training routines. Details and analysis of our proposed approach are provided in Section 4 and Section 5.
The image filtering strategy proposed in this paper can be exploited as a data augmentation, which we show being beneficial also for robustness against common corruptions (e.g., shot noise, pixelate, glass blur). Additionally, our framework allows for high flexibility in the choice of its key components, as long as its underpinning principles are not violated.
Our contributions can be summarized as follows: • We introduce a novel image filtering framework, dubbed Image-Graph Extractor (IGE), whose main objective is to remove textures while preserving the image's semantic content. Our framework is based on an implicit graph representation of images, the Image-Graph (IG).
• We propose an effective defense against bounded adversarial attacks, called Filtering As a Defense (FAD), leveraging the textures suppression effect of IGE.
• We exploit filtered images produced through the IGE filtering framework as a data augmentation strategy. We show that models trained with our data augmentation strategy are more robust against common corruptions such as shot noise, pixelate, glass blur.
While IGE has been primarily conceived and designed to enforce robustness through explicit textures suppression in the input image, the intermediate graph representation necessary for the iterative filtering procedure might prove useful in many other applications. In fact, the IG associated with the input image enables the emergence of structure in an unstructured domain. The extracted structure, if adequately exploited, might boost performance in downstream tasks. This will be the subject of further investigations in future research.
The paper is organized as follows. In Section 2 we review existing literature related to our work. Section 3 lays out the necessary notation and preliminary concepts. In Section 4 we introduce and analyze our IGE framework, while Section 5 describes the FAD defense. In Section 6 we present the results of our experiments. In Section 7 we discuss limitations and potential improvements of our framework. In Section 8 we summarize our findings and point to some possible research directions for future work.

Related Work
Since the discovery of the existence of adversarial examples [26], countless attempts to make image classifiers robust to adversarial perturbations have appeared in the literature. As anticipated in Section 1, current stateof-the-art methods to enforce robustness directly leverage adversarial examples during training [8,12,14,16]. A major limitation affecting AT is the high computational cost as adversarial examples are typically crafted through iterative optimization routines. For this reason, significant efforts have been made to improve the robustness of models without resorting to AT. Proposed solutions cover a wide range of techniques based on curvature regularization [17], robust optimization to improve local stability [23], the use of additional unlabeled data [4], local linearization [21], Parseval networks [5], defensive distillation [19], model ensembles [18], channel-wise activations suppressing [2], feature denoising [29], self-supervised learning for adversarial purification [25], and input manipulations [7,9,15]. All the listed techniques, except those based on input manipulations, require training the model or an auxiliary module from scratch. Our method, instead, can be used in combination with pretrained models.
In [15] the authors analyze the effect of image rescaling on adversarial examples. [7] explores the possibility to improve robustness through JPG (re)compression, based on the intuition that adversarial perturbations are unlikely to leave an image in the space of JPG images. In [9], the authors assess the effectiveness of input transformations based on image cropping and rescaling, bitdepth reduction, JPEG compression, total variance minimization, and image quilting. The main objective is to remove the adversarial perturbations from images, while preserving sufficient information to correctly classify them. Unlike the mentioned input-based techniques that only implicitly (or not at all) induce mitigation of the bias towards textures, our method makes this effect explicit by directly removing textures from the input image.

Preliminaries and Notation
We introduce here the notation used throughout this paper. We focus on image classification problems where a classifier f θ (·) is encoded by a DNN parameterized by θ ∈ R |θ| . The parameters vector θ is optimized by minimizing a suitable loss function L(x, y; θ) on samples (x, y) drawn from the underlying training data distribution D. A training sample consists of an RGB (normalized) image x ∈ X ⊂ [0, 1] 3×h×w and the corresponding true label y ∈ {1, . . . , K} (as common practice, we assume h = w). We consider the cross-entropy loss optimized using Stochastic Gradient Descent (SGD) [3], which updates the parameters θ with a noisy estimate of the gradient computed from a mini-batch of samples. The predicted label corresponding to the input image x is denoted byŷ = f θ (x).
PGD Given an input image x, Projected Gradient Descent (PGD) [16] is a gradient-based method for finding an adversarial example x that satisfies the condition x − x p ≤ , for given norm · p and perturbation budget > 0. Let B denote the p -ball of radius centered at x. The attack is initialized at a random point x 0 ∈ B, and repeatedly applies (for a pre-specified number of iterations) the following update rule: Here, L(x, y) is a loss function (e.g., cross-entropy), α is a step-size, Π B projects an input onto B, and g is the gradient, that represents the steepest ascent direction for a given p -norm.

Image Graph Extractor
In this Section we introduce the IGE framework. For the sake of readability, we first highlight the guiding principles at its core (Section 4.1) and describe thoroughly its key components, i.e., the merging rule (Section 4.2) and the iterative filtering procedure (Section 4.3). All the design choices characterizing the specific instance of the IGE method used for our experiments are discussed in more detail in Section 4.4. In order to satisfy parallel and efficient image processing we developed IGE in CUDA/C++ and NVIDIA Thrust. Implementation details are given in Appendix A.

Guiding Principles
The information contained in an image depends on the effective resolution r we see at: when 'zooming out' the image (i.e., decreasing r), pixels that are distinct at higher resolutions are no more distinguishable and merge together forming patches with larger size. Conversely, finer details emerge when 'zooming in' the image (i.e., increasing r) and patches split into multiple sub-patches with smaller sizes. Based on these observations, an image x at a given resolution r can be represented as a graph, where nodes correspond to patches of similar pixels and edges encode information about connectivity of the different patches. The size of each node amounts to the number of pixels the corresponding patch is composed of. As a result, each image can be partitioned into a collection of patches according to an underlying graph representation.

Merging Rule
The objective of IGE is to emulate the perceptual effects described in Section 4.1. While the produced filtered images reveal complex elaborations that might be hard to model, IGE is driven by a simple merging rule, which we describe hereinafter. Let x r be an image at resolution r and let G r = (V r , E r ) be the corresponding IG, where V r is the set of nodes and E r the set of edges at resolution r. For simplicity, we assume edges to be binary-valued, with e r i,j = 1 indicating that v r i and v r j are neighboring nodes (e r i,j ∈ E r and v r i , v r j ∈ V r ). In the image domain, this translates into the fact that patches corresponding to v r i and v r j are neighbors (according to some specified criterion). Let s r i and s r j be the size of nodes v r i and v r j , respectively. We define the color associated with node v r i (dubbed c r i ) as the average value of pixels in v r i . Given an opportune color distance d c , we define the adjusted distance d a as for some function φ(·). Notice that d a is function of the color distance d c (c r i , c r j ), the size of nodes s r i and s r j , and the resolution r. Neighboring nodes v r i and v r j are merged if where τ (d 0 , r) is the threshold (function of the resolution r) that determines if two nodes are in the same patch at a given resolution r. The parameter d 0 represents the minimum color distance perceived at maximum resolution r 0 , corresponding to the resolution of the original (unfiltered) image x = x r0 . We assume by convention that r 0 = 1. In order to be consistent with the guiding principles in Section 4.1, τ must be a monotonically decreasing function with respect to r, that is ∂τ (d 0 , r) ∂r < 0. Indeed, as we zoom out the image (r decreases), pixels that are more and more distant from each other in color space become indistinguishable, resulting in a less strict threshold.
The adjustment of the color distance d c modeled by Equation (1) takes into account the size of nodes. The rationale of the proposed procedure can be better explained by an example: a black 1-pixel node surrounded by white pixels becomes perceptually indistinguishable from its neighbors at a far larger resolution if compared to a black 5-pixels node.
In summary, the core of the IGE framework is represented by the merging rule described in this Section. The key ingredients defining the rule are: the criterion used to determine neighboring patches, the color distance d c , the adjusted distance d a (specifically, the function φ), the minimum color distance perceived at maximum resolution d 0 , and the threshold function τ . The choice of the latters is subject to the following constraints: C1. If all the variables but r are kept fixed, it is required that ∂τ (r) ∂r < 0 and/or ∂da(r) C2. If all the variables but s r i are kept fixed, it is required that C3. If all the variables but d c are kept fixed, ∂d a ∂d c > 0.
The IGE framework is general in that it allows flexibility in the choice of the key ingredients as long as the constraints listed above are satisfied. In Section 4.4 are given the specific design choices adopted in this work.

Iterative Filtering
The iterative filtering procedure consists in repeatedly performing merging operations, after a preliminary phase for initialization. The functioning of the whole IGE framework is summarized in Algorithm 1.
Let r * be the target resolution and r 0 = 1 the initial resolution corresponding to the original image x, as mentioned in Section 4.2. In our framework, the target resolution r * ∈ ]0, r 0 [, together with the filtering step size ∆ r , defines the number of filtering steps N r = 1−r * ∆r to be performed.
The initialization phase is aimed at extracting the IG G r0 associated with the original image x = x r0 . We represent this operation with the generic function img2graph.
The filtering routine can be seen as an anti-causal discrete dynamical system G r−∆r = m(G r ), where m is the map obtaining G r−∆r from G r . Specifically, m is composed of the following elementary operations: 1. Merge nodes according to Equation (2) (we denote this operation with the function merge).
2. Update the color value of each node by averaging the values of all pixels in the node (we denote this operation with the function avg color).
The map m is applied iteratively N r times until the target resolution r * is reached. The final step consists in reconstructing the filtered image at the target resolution from the final IG G r * . We represent this operation with the generic function graph2img.
A potential issue that might arise is the co-existence, for a specific node, of multiple candidate nodes for the merging operation. Although not optimal from a computational point of view, one trivial solution would be to choose the candidate node with the smallest adjusted distance. In this regard, the filtering step size ∆ r controls the goodness of the filtering process. Small values of ∆ r help in mitigating the problem of multiple candidate nodes for merging. Since N r ∝ ∆ −1 r , also this strategy should call for thoughtful considerations about computational cost. In light of this, we set ∆ r to the biggest value that guarantees the required quality of the filtered images.
Notice that the IG associated with the filtered image at the target resolution r * can be extracted with no extra computations as it comes as an intermediate byproduct of the filtering procedure. The IG can be enriched by considering additional node attributes besides node color (e.g., shape) and encoding additional information about connectivity as edge attributes. A simplified example of IG is depicted in Figure 2

Design Choices
As stated in Section 4.2, to define an instantiation of the IGE method we need to specify: (i) the criterion used to define neighboring patches (i.e., the minimum number of neighboring pixels), (ii) the color distance d c , (iii) the adjusted distance d a (specifically, we should define φ), (iv) the minimum color distance perceived at maximum resolution d 0 and (v) the merging threshold function τ .
As for (i), we consider two distinct patches as neighbors if their connection is at least one pixel. While simple, this choice could cause merges that are not optimal.
A possible improvement may come by defining a different threshold.
In respect of the color distance d c , we tested two formulations: CIEDE2000 [24] and Euclidean. While CIEDE2000 offers more human-aligned color perception, we did not appreciated significant differences. Thus, we opted for the Euclidean distance. Given two RGB vectors p = [p R , p G , p B ] and q = [q R , q G , q B ] their Euclidean distance is given by For the adjusted distance d a , we adopted the following formulation where the color distance d c and adjustmentφ terms are decoupled. We set α = 0.04 and β = 10.
The termφ has the objective of reducing the perceived color distance when the resolution is low and/or the size of nodes is small. The size adjustment is represented by the term min{s r i , s r j }, meaning that the decision depends on the smallest node. This is aimed to reproduce the behavior of vanishing nodes as we zoom out the image. However, this rule may be refined by also considering the relative size, that is s r i /s r j . The term β r is helpful to incentivize the early merge of small nodes. We want to remark that we tested several rules φ. Interestingly, the quality of results is stable with respect to the choice of φ as soon as it satisfies the constraints of the IGE framework.
Regarding the threshold function τ we investigated two different forms: T1 is not linear. Thus, at low resolutions a small change in r can have a visible impact on filtering. We opted for T2 even if also T1 provided good results. Moreover, we would like to remark that there is no 'correct' rule. The form controls how we establish to perceive the zooming and image structures. We set d 0 = 0.03.

Filtering As a Defense
In this Section we describe FAD, our proposed defense against adversarial attacks leveraging the IGE iterative filtering procedure. We first discuss the motivation in Section 5.1 and then introduce the full defense protocol in Section 5.2.

Motivation
We want to provide an intuitive argument about the effectiveness of FAD. Let x be an input image of n = h×w pixels and let x r * its filtered counterpart at a given target resolution r * . We define p as the effective number of pixels in the filtered image x r * , that is, the number of patches the filtered image is composed of. In the context of the IGE framework, p is equivalent to the number of nodes in the IG G r * associated with the filtered image x r * . Intuitively, we may think the filtered image as a √ p × √ p image. As p ≤ n (and potentially p n), it is evident that the total number of directions that an attacker can exploit decreases significantly if compared to the original input image.
As discussed in Section 1, in order to be effective the attacker must have the possibility to create local micropatterns characterized by precise relative spatial locations. Said micro-patterns, correlated together across layers, cause the classification error. In standard settings (i.e., when dealing with unfiltered images), the attacker has the freedom to perturb the image along almost any direction not too far from the original one. In visual terms, this amounts to the fact that the adversarial example is perceptually very similar to the original image. When considering filtered images, this assumption is not valid anymore and the actual number of effective directions the attacker can focus on is limited. This fact can be intuitively explained by comparing the underlying structures of original and filtered images. For original images, the structure is represented by a rigid uniform grid: if we assume 8-connectivity, each pixel's neighborhood has fixed size equal to 8. The effect of perturbing a single pixel directly impacts (in terms of created 'virtual edges') only the 8 pixel's neighbors. For filtered images, instead, the structure is represented by a nonuniform grid defined by the IG associated with the image. This allows patches (corresponding to nodes in the IG) to potentially border with many other patches. In the worst case scenario, from the perspective of the attacker, a single patch could border with all other patches. In this case, the perturbation of a single patch would impact all other patches (in terms of created 'virtual edges'), leading to a loss in precision for the attacker.

Defense Protocol
The IGE filtering procedure outlined in Section 4 causes a shift in the input image statistics that results in distribution shifts of batch norm layers' inputs. Thus, especially in complex datasets like ImageNet, models are less accurate when evaluated on filtered images as population statistics estimated on training data do not match statistics of test data.
To overcome this mismatch, the first phase of the protocol is represented by fine-tuning the pretrained model to align to filtered images. Since the semantic content of input images is preserved, the fine-tuning process requires only a few epochs to converge.
The second phase is the defense itself, which consists in running the IGE iterative filtering routine as a pre-processing step as soon as an input image is queried. Figure 3 reports the described FAD defense. Notice that the FAD defense module inherits the parameters defining the specific instantiation of the IGE filtering method.

Results
In this Section we present three sets of results: (i) the visual inspection of filtered images, (ii) FAD under attack, and (iii) data augmentation with filtered images. Additional analyses are presented in the Appendices B and C.

Filtering
In Figure 4 we show the progression of the iterative filtering process, i.e., the resulting filtered images as the target resolution varies. When reducing the target resolution, the number of nodes progressively decreases. However, the semantic content of the image remains preserved. In Figure 5 we show few examples of filtered images with fixed target resolution r * = 0.6. The final number of nodes depends on the complexity of the original image. On average, at target resolution r * = 0.6, images have roughly [150, 1000] nodes.

Robustness Evaluation
As discussed by [27], one should develop adaptive attacks to test the robustness of a defense. In this context, the Backward Pass Differentiable Approximation (BPDA) is a gradient approximation technique [1] for dealing with non-differentiable components. Letf be the compositionf (x) = f • h(x) where h is nondifferentiable (or hard to differentiate). In our case h is the FAD module and f represents the fine-tuned model. To approximate the total gradient ∇ xf (x), BPDA needs to find a differentiable function g(x) such that g(x) ≈ h(x). Then, when computing the gradient ∇ xf (x), the forward pass is a standard forward pass throughf (including the forward pass through h), while in the backward pass h is replaced by g. In our case, a reasonable choice for g is the identity function g(x) = x as the FAD module is a simple 'denoising' layer.
A vanilla application of BPDA may not be effective as one step of gradient might not allow the attacker to craft adversarial patches. Hence, we apply BPDA (as an outer loop) with the only difference of an inner attack (addressed to f ) where multiple PGD steps are applied.

Experimental Settings
We validate FAD with the datasets CIFAR-10 [13], CIFAR-100 [13] and ImageNet [6]. As discussed in Section 5.2, filtered images exhibit different statistics if compared to their original counterparts. For this reason, the first phase of the FAD protocol is a fine-tuning of the model. While the optimal solution would be to fine-tune the model with the same resolution used in the  FAD module, we decided to fine-tune the model for only one resolution r * = 0.6. We do this as it provides a good balance between simplicity and accuracy. For all the datasets, we employ ResNet-18 [10] architectures trained for 150 epochs, initial learning rate η = 0.1 and a drop of η by a factor 10 every 50 epochs.
As regards BPDA, we evaluate FAD with 50 outer steps and 20 inner steps. Attacks are bounded in 2norm. Due to computational constraints, we tested on 30% of the test sets with shuffling. Table 3 presents the results when attacking FAD with BPDA for CIFAR-10, CIFAR-100 and ImageNet, respectively. As the resolution increases, the attacker prevails the defense, and the robust accuracy decreases. The same holds for . For values of bigger than the reported ones, accuracy quickly approaches zero. These behaviors are adherent to what one should expect. By reducing r * , fewer textures are present, and the attacker is less effective. As regards the attack strength, when increases, the attacker succeeds in creating new relatively small but strong patches or in removing patches that impact the shape (see Figure 6).

Data Augmentation with Filtered Images
As IGE removes textures, we may expect more robustness to corruptions. To test this hypothesis, we trained a ResNet-18 model f aug on CIFAR-10 by augmenting the training set of natural images x with their corresponding filtered counterparts x r * (r * = 0.6). The resulting augmented dataset is denoted D aug = {D, D r * }. The test set used for the evaluation is the original one (i.e., formed only by natural images). As we may expect, the accuracy of f aug drops in relation to that of f nat (from roughly 95% to 93.3%). However, if we look at the response of the two models under data corruption, f aug is almost always more accurate than f nat . In some cases, e.g., glass blur, the gap is remarkable. The results are reported in Table 2. The code for applying data corruptions has been adapted from [22].

Discussion
In the following, we list the major limitations of IGE. Regarding the implementation, although images are preprocessed using a GPU, it is still not ready for real-time applications. However, we pinpoint several improve- ments. The first is to increase computational performance by efficiently using the GPU architecture (e.g., threads and warping). The second direction regards the design of tailored merging rules to reduce the number of steps required.
We want to remark that we did not spend much effort tuning parameters and merging rules. Indeed, our main interest is to show that the model gains robustness by injecting the local stability of pixels. We believe that the design of better merging rules will help improving accuracy and robustness. Moreover, we expect further improvements by training models on a tailored resolution instead of using a unique model for all the resolutions.

Conclusions
This paper introduces a GPU-based image filtering framework, Image-Graph Extractor (IGE). Its outputs are the filtered image and the corresponding Image-Graph (IG). One of the several benefits of IGE is that it effectively enforces robustness to bounded perturbations by removing brittle textures from images.
Although the main focus is on the use of IGE for adversarial robustness, its flexible IG representation opens to several directions for future research. The first one concerns the use of the IG representation to cast image classification as a graph classification problem. This would allow to easily inject in the model user-defined data invariances (e.g., to the scale of objects). Another research direction consists in defining a specialized data augmentation strategy where nodes can be cleverly perturbed so as to remove common shortcut features such as the background color.

A. Implementation Details
In order to satisfy parallel and efficient image processing we developed IGE in CUDA/C++ and NVIDIA Thrust. The first piece of filtering is the extraction of connected-components. We use the GPU-based CCL (Connected Component Labeling) algorithm adapted from [20]. The output of CCL is the h × w label matrix, where each location contains the identifier of the node/patch. After running CCL, we run a CUDAkernel called edge which takes in input the label matrix edge <<< grid, block, block.x * block.y>>> and outputs the graph (node, edge) in dataframe-like standard. That is, each connection consists of a row with source, destination and attributes. Attributes are color distance, number of connected pixels, etc. After the first phase, the actual filtering procedure starts. At each step, the merge function is implemented in two phases: the first function has the objective to define the candidates for merging, while the second function actually merge nodes. After the merge, the filtered image is reconstructed with the function avg color that takes in input the label matrix and the original images and return the filtered images by averaging color for each node. Moreover, the graph can be optionally saved on csv files and elaborated with the NVIDIA library libcudf (https://github.com/rapidsai/cudf/).
The python wrapper has been developed using pybind11. For future releases, we plan to develop a Torch extensions.

B. IGE
With high-dimensional images, we have found beneficial to apply a de-noising pre-processing that consists of a partial removal of textures by the minimization of the following: where x is the raw image, L T V is the total variation loss and L surf is the surface loss. The objective of L surf loss is to minimize the number of changes in color pixel. In fact, total variation can be low even when the number of changes in pixels is very high. This happens for example when changes in color are minimal (e.g. 1 or 2 out of 255). The change of pixels' color is defined with the step function 1(·), which is not differentiable. We approximate the step function with the differentiable surrogate:

C. FAD
Models are fine-tuned for 10 epochs with learning rate η = 0.001 and fixed resolution r * = 0.6. For Im-ageNet, we sample 300 filtered images per class from the training set. In Table 3 and Table 4 are reported the results when attacking FAD with BPDA with attacks bounded in 2 -norm and ∞ -norm, respectively. As regards BPDA, we evaluate FAD with 50 outer steps and 20 inner steps. We did not take into account other whitebox attacks (such as C&W) since we consider PGD with BPDA to be the strongest attack we could evaluate against.     Table 4. Robust accuracy (in %) and loss for CIFAR-10 , CIFAR-100 and ImageNet under BPDA ∞-attack at different resolution scales. Attacked models are fine-tuned with r * = 0.6.