  It is extensively studied that Deep Neural Networks (DNNs) are vulnerable to
Adversarial Examples (AEs). With more and more advanced adversarial attack
methods have been developed, a quantity of corresponding defense solutions were
designed to enhance the robustness of DNN models. It has become a popularity to
leverage data augmentation techniques to preprocess input samples before
inference to remove adversarial perturbations. By obfuscating the gradients of
DNN models, these approaches can defeat a considerable number of conventional
attacks. Unfortunately, advanced gradient-based attack techniques (e.g., BPDA
and EOT) were introduced to invalidate these preprocessing effects.
  In this paper, we present FenceBox, a comprehensive framework to defeat
various kinds of adversarial attacks. FenceBox is equipped with 15 data
augmentation methods from three different categories. We comprehensively
evaluated that these methods can effectively mitigate various adversarial
attacks. FenceBox also provides APIs for users to easily deploy the defense
over their models in different modes: they can either select an arbitrary
preprocessing method, or a combination of functions for a better robustness
guarantee, even under advanced adversarial attacks. We open-source FenceBox,
and expect it can be used as a standard toolkit to facilitate the research of
adversarial attacks and defenses.
