  We present a simple yet effective method to improve the robustness of
Convolutional Neural Networks (CNNs) against adversarial examples by
post-processing an adversarially trained model. Our technique, MeanSparse,
cascades the activation functions of a trained model with novel operators that
sparsify mean-centered feature vectors. This is equivalent to reducing feature
variations around the mean, and we show that such reduced variations merely
affect the model's utility, yet they strongly attenuate the adversarial
perturbations and decrease the attacker's success rate. Our experiments show
that, when applied to the top models in the RobustBench leaderboard, it
achieves a new robustness record of 72.08% (from 71.07%) and 59.64% (from
59.56%) on CIFAR-10 and ImageNet, respectively, in term of AutoAttack accuracy.
Code is available at https://github.com/SPIN-UMass/MeanSparse
