# Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

**Authors:** Weilin Xu, David Evans, Yanjun Qi  
**arXiv:** [1704.01155](https://arxiv.org/abs/1704.01155)  
**Date:** 2017-04-04  
**Summary page:** https://www.summarizepaper.com/en/paper/1704.01155v1/

## Key points

- Deep neural networks (DNNs) have achieved remarkable success in computer vision.
- Adversarial examples are small distortions added to input data that can deceive DNN models.
- Previous attempts to defend against adversarial examples have shown limited success and require expensive processes.
- The authors propose a new strategy called "feature squeezing" to detect adversarial examples and harden DNN models.
- Feature squeezing reduces the search space available to an adversary by coalescing samples into a single sample.
- By comparing predictions on original and squeezed inputs, feature squeezing accurately detects adversarial examples with minimal false positives.
- Two instances of feature squeezing explored: reducing color bit depth and smoothing using a spatial filter.
- These strategies are straightforward, inexpensive, and effective at enhancing DNN model robustness in computer vision tasks.

## Summary

In the field of computer vision, deep neural networks (DNNs) have achieved remarkable success. However, recent studies have revealed a vulnerability in these networks known as adversarial examples. Adversarial examples are created by adding small but purposeful distortions to input data, which can often deceive DNN models. Previous attempts to defend against adversarial examples have primarily focused on refining the DNN models themselves, but these approaches have shown limited success and require computationally expensive processes. To address this issue, the authors propose a new strategy called "feature squeezing" that aims to harden DNN models by detecting adversarial examples. Feature squeezing works by reducing the search space available to an adversary through coalescing samples that correspond to different feature vectors in the original space into a single sample. By comparing a DNN model's prediction on the original input with its prediction on the squeezed input, feature squeezing can accurately detect adversarial examples with minimal false positives. The paper explores two instances of feature squeezing: reducing the color bit depth of each pixel and smoothing using a spatial filter. These strategies are straightforward and inexpensive yet effective at detecting adversarial examples and enhancing the robustness of DNN models in computer vision tasks. Overall, this research highlights the importance of addressing vulnerabilities caused by adversarial examples and provides an effective means for doing so via feature squeezing technique.