Feature Squeezing

Reduces the bit depth of each color channel (e.g., from 8-bit to 4-bit) to collapse similar pixel values into a single value. This quantization eliminates the subtle, sub-pixel perturbations that adversarial attacks rely on.

• Mechanism: Maps 256 distinct values per channel to 16 or fewer bins.
• Effect: Forces the adversary to create perturbations large enough to cross quantization thresholds, making the attack visible or structurally detectable.
• Trade-off: Minimal impact on human perception for natural images, but can degrade fine-grained classification on low-contrast medical imagery.

Applies a median filter or Gaussian blur to the input, replacing each pixel with the median or weighted average of its local neighborhood. This destroys the high-frequency, structured noise that characterizes adversarial perturbations.

• Median Filter: Particularly effective against salt-and-pepper style adversarial noise and L0-bounded attacks.
• Gaussian Blur: Smooths gradient-based perturbations like those from Projected Gradient Descent (PGD).
• Kernel Size: A 2x2 or 3x3 kernel is standard; larger kernels risk destroying legitimate high-frequency features like text or fine edges.

A sophisticated squeezer that replaces each pixel with a weighted average of all pixels in the image, where weights are determined by the similarity of local patches. Unlike local smoothing, non-local means preserves fine structures and textures while removing adversarial noise.

• Advantage: Superior preservation of edges and repetitive patterns compared to Gaussian or median filters.
• Detection Logic: If the model's prediction on the denoised input diverges significantly from the original, the input is flagged as adversarial.
• Cost: Computationally more expensive than simple spatial filters, making it a candidate for selective application on suspicious inputs.

Re-encodes the input image using a lossy JPEG compression codec to discard high-frequency components in the discrete cosine transform (DCT) domain. Adversarial perturbations, which often manifest as fragile high-frequency signals, are destroyed during the quantization of DCT coefficients.

• Quality Factor: A lower quality setting (e.g., 75-85) applies more aggressive squeezing.
• Limitation: Less effective against attacks that constrain perturbations to the low-frequency domain or those specifically designed to survive JPEG compression.
• Synergy: Often combined with other squeezers in an ensemble to cover different attack vectors.

The core detection mechanism: compare the model's output vector on the original input against its output on the squeezed input. A significant L1 distance between the two probability distributions indicates an adversarial example.

• Thresholding: A calibrated threshold on the L1 divergence score separates legitimate variations from adversarial manipulation.
• Ensemble Squeezing: Applying multiple squeezers (e.g., bit reduction + median filter) and aggregating divergence scores increases detection robustness against adaptive attacks.
• White-Box Resilience: Even if an attacker knows the squeezers are in place, they must generate perturbations large enough to survive all squeezers simultaneously, which often breaks the imperceptibility constraint.

A discretization technique that represents each pixel value as a binary vector where the k-th bit is 1 if the pixel value exceeds a threshold k. This unary encoding linearizes the input space and breaks the differentiable relationship between pixel intensity and model output.

• Mechanism: A pixel with value 0.7 becomes [1,1,1,1,1,1,1,0,0,0] for 10 discretization levels.
• Defense Property: Gradient-based attacks like PGD cannot compute meaningful gradients through the discretized representation.
• Cost: Expands input dimensionality by a factor equal to the number of discretization levels, increasing memory and compute requirements.

An input to a machine learning model that has been intentionally perturbed in a way imperceptible to humans, causing the model to make an incorrect classification with high confidence. Feature squeezing aims to neutralize these perturbations by reducing the input's degrees of freedom.

• Target: Image classifiers, object detectors, speech-to-text
• Mechanism: Adds carefully calculated noise to exploit model blind spots
• Example: A panda photo with added noise classified as a gibbon at 99.3% confidence

A type of adversarial attack performed at inference time where the attacker modifies the input sample to cause misclassification without altering the underlying model. Feature squeezing is a direct countermeasure to evasion attacks.

• Attack surface: Deployed models exposed to user-provided inputs
• Key distinction: Does not require training data access, only query access
• Defense approach: Squeezing removes the perturbation space attackers rely on

A phenomenon where a defense gives a false sense of security by producing non-useful or zero gradients. While feature squeezing can cause gradient masking if implemented naively, proper evaluation with adaptive attacks reveals true robustness.

• Risk: Defenders believe their model is secure when it is not
• Detection: Test against black-box and transfer attacks, not just white-box
• Best practice: Always evaluate squeezed models against attacks that account for the squeezing pipeline

A defensive technique that augments the training dataset with adversarially perturbed examples labeled with the ground-truth class. Unlike feature squeezing—which is a detection method applied at inference—adversarial training builds robustness directly into the model's decision boundaries.

• Complementary use: Train robustly, then squeeze at runtime for defense-in-depth
• Cost: Increases training time by 3-10x depending on attack iterations
• Standard benchmark: PGD-based adversarial training on CIFAR-10 and ImageNet

An attack methodology that assumes full knowledge of a defense mechanism and is specifically designed to circumvent it. For feature squeezing, an adaptive attacker would incorporate the squeezing operations into their optimization loop.

• Evaluation standard: The only valid way to measure true defense efficacy
• Example: Attacker uses differentiable approximations of bit-depth reduction
• Key insight: If a defense fails against an adaptive attack, it provides no real security

A formal, provable guarantee that a model's prediction will not change for any input perturbation within a specified Lp-norm bound. Unlike feature squeezing's empirical detection approach, certified robustness provides mathematical certainty.

• Techniques: Randomized smoothing, interval bound propagation
• Trade-off: Certified methods typically reduce clean accuracy more than empirical defenses
• Complementary role: Use certification for safety-critical components, squeezing for runtime monitoring