---
# System prepended metadata

title: Adversarial Feature Activation

---

# Adversarial Feature Activation

## Related works

- Most {ReLU} Networks Suffer from 2 Adversarial Perturbations: https://arxiv.org/abs/2010.14927
- Feature Space Perturbations Yield More Transferable Adversarial Examples: https://openaccess.thecvf.com/content_CVPR_2019/papers/Inkawhich_Feature_Space_Perturbations_Yield_More_Transferable_Adversarial_Examples_CVPR_2019_paper.pdf
- Adversarial Manipulation of Deep Representations:
https://arxiv.org/abs/1511.05122
- Mixup / Manifold Mixup connection: https://arxiv.org/abs/1806.05236, $a x_1 + (1-a) x_2$, $a y_1 + (1 - a) y_2$, $a h_1 + (1 - a) h_2$.
- https://arxiv.org/pdf/2005.10190.pdf
- Overfitting in adversarially robust deep learning: https://arxiv.org/abs/2002.11569, https://github.com/locuslab/robust_overfitting
- Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse
Parameter-free Attacks: https://arxiv.org/pdf/2003.01690.pdf

## Method

- Sample a mask of features that you want either activate or deactivate features at layer $l$: find input $x$ or hidden representation $h_{<l}$ in the lower layers by gradient based attack. 