  We propose a novel and effective purification based adversarial defense
method against pre-processor blind white- and black-box attacks. Our method is
computationally efficient and trained only with self-supervised learning on
general images, without requiring any adversarial training or retraining of the
classification model. We first show an empirical analysis on the adversarial
noise, defined to be the residual between an original image and its adversarial
example, has almost zero mean, symmetric distribution. Based on this
observation, we propose a very simple iterative Gaussian Smoothing (GS) which
can effectively smooth out adversarial noise and achieve substantially high
robust accuracy. To further improve it, we propose Neural Contextual Iterative
Smoothing (NCIS), which trains a blind-spot network (BSN) in a self-supervised
manner to reconstruct the discriminative features of the original image that is
also smoothed out by GS. From our extensive experiments on the large-scale
ImageNet using four classification models, we show that our method achieves
both competitive standard accuracy and state-of-the-art robust accuracy against
most strong purifier-blind white- and black-box attacks. Also, we propose a new
benchmark for evaluating a purification method based on commercial image
classification APIs, such as AWS, Azure, Clarifai and Google. We generate
adversarial examples by ensemble transfer-based black-box attack, which can
induce complete misclassification of APIs, and demonstrate that our method can
be used to increase adversarial robustness of APIs.
