  Robustness of convolutional neural networks (CNNs) has gained in importance
on account of adversarial examples, i.e., inputs added as well-designed
perturbations that are imperceptible to humans but can cause the model to
predict incorrectly. Recent research suggests that the noises in adversarial
examples break the textural structure, which eventually leads to wrong
predictions. To mitigate the threat of such adversarial attacks, we propose
defective convolutional networks that make predictions relying less on textural
information but more on shape information by properly integrating defective
convolutional layers into standard CNNs. The defective convolutional layers
contain defective neurons whose activations are set to be a constant function.
As defective neurons contain no information and are far different from standard
neurons in its spatial neighborhood, the textural features cannot be accurately
extracted, and so the model has to seek other features for classification, such
as the shape. We show extensive evidence to justify our proposal and
demonstrate that defective CNNs can defense against black-box attacks better
than standard CNNs. In particular, they achieve state-of-the-art performance
against transfer-based attacks without any adversarial training being applied.
