Search papers, labs, and topics across Lattice.
This paper evaluates the effectiveness of preprocessing defenses against adversarial attacks specifically in depthwise-separable CNNs, which are prevalent in edge vision systems. The study reveals that these architectures exhibit consistently poor recovery from adversarial perturbations compared to residual architectures, highlighting a significant gap in the existing security evaluation literature. Importantly, the findings suggest that while preprocessing fails to enhance recovery, it creates a detectable divergence between clean and adversarial predictions, offering a new avenue for adversarial detection without requiring model retraining.
Preprocessing defenses fail to recover adversarially perturbed inputs in depthwise-separable CNNs, but they reveal a new detection opportunity through measurable output divergence.
Preprocessing-based defenses are the standard first-line response to adversarial attacks on edge vision systems, requiring no retraining, no architectural changes, and widely recommended as model-agnostic mitigations. Yet the foundational evaluations of these defenses were conducted on residual or Inception-class architectures, not on the depthwise-separable CNNs that dominate edge deployments. This untested assumption leaves a gap in the security evaluation literature. This paper closes that gap by evaluating six preprocessing defenses against adversarial perturbations across both architecture families. Across all perturbation levels and defenses tested, the two depthwise-separable architectures show consistently poor recovery while the residual architecture shows partial recovery; ablation results are consistent with an architectural rather than parametric explanation, though only three architectures and one attack family are evaluated. Crucially, this failure is not merely a negative result. The same output divergence that disqualifies preprocessing as a recovery mechanism reveals a detection opportunity: preprocessing consistently disrupts clean predictions while leaving adversarial predictions largely unchanged, an asymmetry that is directly measurable without retraining or architectural modification. We further show that standard image quality metrics are unreliable proxies for defense effectiveness, a methodological gap in current evaluation practice. A practitioner decision framework is provided for adversarially resilient edge vision deployment.
