Deep Learning models are highly susceptible to adversarial manipulations that can lead to catastrophic consequences. One of the most effective methods to defend against such disturbances is adversarial training but at the cost of generalization of unseen attacks and transferability across models. In this paper, we propose a robust defense against adversarial attacks, which is model agnostic and generalizable to unseen adversaries. Initially, with a baseline model, we extract the latent representations for each class and adaptively cluster the latent representations that share a semantic similarity. We obtain the distributions for the clustered latent representations and from their originating images, we learn semantic reconstruction dictionaries (SRD). We adversarially train a new model constraining the latent space representation to minimize the distance between the adversarial latent representation and the true cluster distribution. To purify the image, we decompose the input into low and high-frequency components. The high-frequency component is reconstructed based on the most adequate SRD from the clean dataset. In order to evaluate the most adequate SRD, we rely on the distance between robust latent representations and semantic cluster distributions. The output is a purified image with no perturbation. Image purification on CIFAR-10 and ImageNet-10 using our proposed method improved the accuracy by more than 10% compared to state-of-the-art results.
Shanghai JiaoTong University（上海交通大学）；The Chinese University of Hong Kong（香港中文大学）；Shanghai AI Laboratory（上海人工智能实验室）
With wider application of deep neural networks (DNNs) in various algorithms and frameworks, security threats have become one of the concerns. Adversarial attacks disturb DNN-based image classifiers, in which attackers can intentionally add imperceptible adversarial perturbations on input images to fool the classifiers. In this paper, we propose a novel purification approach, referred to as guided diffusion model for purification (GDMP), to help protect classifiers from adversarial attacks. The core of our approach is to embed purification into the diffusion denoising process of a Denoised Diff…
Efficient Model-Based Purification Against Adversarial Attacks for LiDAR Segmentation
Industrial Systems Institute, Athena Research Center, Patras Science Park, Greece（工业系统研究所，雅典研究中心，帕特拉斯科学公园，希腊）；AviSense.AI, Patras Science Park, Greece（AviSense.AI，帕特拉斯科学公园，希腊）
Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization
Tokyo University of Agriculture and Technology（东京农工大学）；RIKEN Center for Advanced Intelligence Project (RIKEN AIP)（理化学研究所先进智能项目中心）；Hangzhou Dianzi University（杭州电子科技大学）
Adversarial attack is aimed at fooling the target classifier with imperceptible perturbation. Adversarial examples, which are carefully crafted with a malicious purpose, can lead to erroneous predictions, resulting in catastrophic accidents. To mitigate the effects of adversarial attacks, we propose a novel purification model called CAP-GAN. CAP-GAN takes account of the idea of pixel-level and feature-level consistency to achieve reasonable purification under cycle-consistent learning. Specifically, we utilize the guided attention module and knowledge distillation to convey meaningful informat…
VideoPure: Diffusion-based Adversarial Purification for Video Recognition
Shanghai Engineering Research Center of AI Robotics, Academy for Engineering & Technology, Fudan University（复旦大学工程与技术学院上海市人工智能机器人工程研究中心）；Engineering Research Center of AI & Robotics, Ministry of Education, Academy for Engineering & Technology, Fudan University（复旦大学工程与技术学院教育部人工智能与机器人工程研究中心）；School of Computer Science, Fudan University（复旦大学计算机科学学院）
Deep learning models are vulnerable to adversarial examples and make incomprehensible mistakes, which puts a threat on their real-world deployment. Combined with the idea of adversarial training, preprocessing-based defenses are popular and convenient to use because of their task independence and good generalizability. Current defense methods, especially purification, tend to remove ``noise" by learning and recovering the natural images. However, different from random noise, the adversarial patterns are much easier to be overfitted during model training due to their strong correlation to the i…
Random Sampling for Diffusion-based Adversarial Purification
Northwestern Polytechnical University（西北工业大学）；The Hong Kong Polytechnic University（香港理工大学）；Harbin Institute of Technology (Shenzhen)（哈尔滨工业大学（深圳））；The Hong Kong University of Science and Technology（香港科技大学）
Neither Adversarial Training Nor Purification: Emergent Adversarial Robustness from Oscillatory Predictive Learning
Ecole polytechnique（巴黎综合理工学院）；Ecole Nationale des Ponts et Chaussées（巴黎国立路桥学校）；Mohamed bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；Okinawa Institute of Science and Technology（冲绳科学技术大学院大学）
Seoul National University（首尔大学）；NAVER Clova；NAVER AI Lab
We propose a novel and effective purification based adversarial defense method against pre-processor blind white- and black-box attacks. Our method is computationally efficient and trained only with self-supervised learning on general images, without requiring any adversarial training or retraining of the classification model. We first show an empirical analysis on the adversarial noise, defined to be the residual between an original image and its adversarial example, has almost zero mean, symmetric distribution. Based on this observation, we propose a very simple iterative Gaussian Smoothing …
ADBM: Adversarial diffusion bridge model for reliable adversarial purification
Tsinghua University（清华大学）；Peking University（北京大学）；Beijing Institute of Technology（北京理工大学）；Aalborg University（奥尔堡大学）；Harbin Institute of Technology, Weihai（哈尔滨工业大学（威海））；Huawei Technologies（华为技术有限公司）
Fighting Fire with Fire (F3): A Training-free and Efficient Visual Adversarial Example Purification Method in LVLMs
Tsinghua University, Tencent（清华大学，腾讯）；Tencent（腾讯）；University of Science and Technology Beijing（北京科技大学）；Tencent, University of Macau（腾讯，澳门大学）；Tsinghua University（清华大学）
Neural Networks are infamously sensitive to small perturbations in their inputs, making them vulnerable to adversarial attacks. This project evaluates the performance of Denoising Diffusion Probabilistic Models (DDPM) as a purification technique to defend against adversarial attacks. This works by adding noise to an adversarial example before removing it through the reverse process of the diffusion model. We evaluate the approach on the PatchCamelyon data set for histopathologic scans of lymph node sections and find an improvement of the robust accuracy by up to 88\% of the original model's ac…
Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
School of Electronic, Electrical and Communication Engineering, UCAS（中国科学院大学电子电气与通信工程学院）；Tencent Corporate（腾讯公司）；Institute of Computing Technology, CAS（中国科学院计算技术研究所）；School of Computer Science and Technology, UCAS（中国科学院大学计算机科学与技术学院）
Clustering models constitute a class of unsupervised machine learning methods which are used in a number of application pipelines, and play a vital role in modern data science. With recent advancements in deep learning -- deep clustering models have emerged as the current state-of-the-art over traditional clustering approaches, especially for high-dimensional image datasets. While traditional clustering approaches have been analyzed from a robustness perspective, no prior work has investigated adversarial attacks and robustness for deep clustering models in a principled manner. To bridge this …
Adversarial Guided Diffusion Models for Adversarial Purification
Tokyo University of Agriculture and Technology（东京农工大学）；RIKEN Center for Advanced Intelligence Project (RIKEN AIP)（理化学研究所先进智能项目中心）；Hangzhou Dianzi University（杭州电子科技大学）
NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences（人工智能安全国家重点实验室，计算技术研究所，中国科学院）；University of Chinese Academy of Sciences（中国科学院大学）
MedFedPure: A Medical Federated Framework with MAE-based Detection and Diffusion Purification for Inference-Time Attacks
School of Electrical and Computer Engineering（电气与计算机工程学院）；Max Planck Institute for Brain Research（马克斯·普朗克脑研究所在法兰克福）；School of Computer Engineering,University of Science and Technology (IUST)（科学技术大学（IUST）计算机工程学院）；Department of Electrical and Computer Engineering（电气与计算机工程系）；University of Waterloo（滑铁卢大学）
Deep neural networks are known to be vulnerable to adversarial examples, where a perturbation in the input space leads to an amplified shift in the latent network representation. In this paper, we combine canonical supervised learning with self-supervised representation learning, and present Self-supervised Online Adversarial Purification (SOAP), a novel defense strategy that uses a self-supervised loss to purify adversarial examples at test-time. Our approach leverages the label-independent nature of self-supervised signals and counters the adversarial perturbation with respect to the self-su…
Enhancing Adversarial Robustness through Multi-Objective Representation Learning
Safe Autonomous Systems, TU Dortmund University, Germany（安全自主系统，图恩多特大学，德国）；Lamarr Institute for Machine Learning and Artificial Intelligence（拉马尔机器学习与人工智能研究所）
Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics
MSU Institute for Artificial Intelligence（莫斯科大学人工智能研究所）；Lomonosov Moscow State University（罗蒙诺索夫莫斯科国立大学）；ISP RAS Research Center for Trusted Artificial Intelligence（ISP俄罗斯科学院可信人工智能研究中心）；Innopolis University（因诺波利斯大学）
Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean…
Diffusion-based Cumulative Adversarial Purification for Vision Language Models
KTH Royal Institute of Technology（皇家理工学院）；Swiss Federal Institute of Technology Lausanne（洛桑联邦理工学院）；University of California, Los Angeles（加州大学洛杉矶分校）；Karlsruhe Institute of Technology（卡尔斯鲁厄理工学院）；CISPA Helmholtz Center for Information Security（信息安全赫尔姆霍兹中心）；RISE Research Institutes of Sweden（瑞典RISE研究机构）；Halmstad University（哈马碧大学）
FMVP: Masked Flow Matching for Adversarial Video Purification
Tsinghua University（清华大学）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；University of New South Wales（新南威尔士大学）；The Chinese University of Hong Kong（香港中文大学）；Peng Cheng Laboratory（鹏城实验室）
Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
School of Electronic, Electrical and Communication Engineering, UCAS, Beijing.（电子、电气与通信工程学院，中国科学院大学，北京）；Key Laboratory of Intelligent Information Processing, Institute of Computing Technology, CAS, Beijing.（智能信息处理重点实验室，计算技术研究所，中国科学院，北京）；School of Computer Science and Technology, UCAS, Beijing.（计算机科学与技术学院，中国科学院大学，北京）；Key Laboratory of Big Data Mining and Knowledge Management, UCAS, Beijing.（大数据挖掘与知识管理重点实验室，中国科学院大学，北京）
